PT-2026-57436

CVE-2026-61429

Published

2026-07-11

Updated

2026-10-15

Description by

CVSS 3.1

8.5

High

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.78

Description A server-side request forgery (SSRF) issue exists in the Crawl4AI/Chromium backend. This flaw allows attackers to bypass SSRF validation by utilizing DNS rebinding and HTTP redirects. By crafting specific URLs that resolve to internal services after the initial validation, an attacker can force the headless browser to follow redirects and read internal responses, which may include sensitive canary values.

Recommendations Update PraisonAI to version 1.6.78 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Dinhvaren

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition