CVE-2026-55535

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58

Description The Jobs API contains a flaw where the validate webhook url() function fails open when a socket.gaierror occurs during DNS resolution. This allows the webhook url parameter to bypass validation if the domain is unresolvable or via a DNS rebinding attack, where a domain initially resolves to a public IP to pass validation and subsequently resolves to an internal address. This can lead to Server-Side Request Forgery (SSRF), enabling an unauthenticated attacker to make requests to internal HTTP services, such as admin panels, databases, or cloud metadata APIs like http://169.254.169.254/.

Recommendations Update PraisonAI to version 4.6.58. As a temporary mitigation, restrict or avoid using the webhook url parameter in the Jobs API until the update is applied.