CVE-2026-55526

Name of the Vulnerable Software and Affected Versions praisonaiagents versions prior to 1.6.58

Description A Server-Side Request Forgery (SSRF) issue exists in the multi-agent teams system. The function host is blocked() in spider tools.py fails to perform DNS resolution on hostnames before they are processed by the scrape page function. Consequently, an attacker can use public wildcard DNS services (e.g., 127.0.0.1.nip.io) to bypass validation and force the system to make HTTP requests to internal loopback or private network addresses. This allows for arbitrary port access and the exfiltration of internal service responses.

This issue affects the following LLM-callable agent tools:

In cloud environments, such as AWS EC2 using IMDSv1, this could lead to the theft of temporary IAM credentials and full cloud account compromise.

Recommendations Update praisonaiagents to version 1.6.58 or later. As a temporary workaround, restrict the use of the scrape page, extract links, crawl, and extract text tools when processing user-supplied URLs.