{"id":"CVE-2026-57114","kind":"vulnerability","aliases":["CVE-2026-57114"],"related":[],"title":"PraisonAI: DNS rebinding bypasses webhook guard, reaching internal networks and metadata","description":"PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, _send_webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm. This issue has been patched in version 4.6.59.","summary":"PraisonAI's Async Jobs API checks webhook URLs when a job is submitted, but the check is not enforced when the webhook is actually sent. An attacker can use a hostname that resolves to a public IP at check time and to loopback, private or cloud metadata addresses at delivery time.","severity":"high","cvss":7.2,"epss":0.00246,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","cloud","praisonai","python","self-hosted"],"not_affected_if":["async-jobs-disabled","patched-4.6.59-or-later"],"how_to_check":"- Check the installed PraisonAI version with `pip show praisonai` and see whether it is in the range 4.5.126 up to but not including 4.6.59.\n- Check whether the Async Jobs API is exposed and accepts `webhook_url` in job requests.","fix":"- Upgrade PraisonAI to `4.6.59` or later.\n- Until upgraded, disable or restrict the Async Jobs API and block outbound webhook delivery to internal and metadata addresses at the network layer.","status":"open","published_at":"2026-10-23T13:17:10+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T03:27:42+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:27:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PraisonAI to `4.6.59` or later.\n- Until upgraded, disable or restrict the Async Jobs API and block outbound webhook delivery to internal and metadata addresses at the network layer.","reach":"internet","title":"PraisonAI: DNS rebinding bypasses webhook guard, reaching internal networks and metadata","impact":"medium","summary":"PraisonAI's Async Jobs API checks webhook URLs when a job is submitted, but the check is not enforced when the webhook is actually sent. An attacker can use a hostname that resolves to a public IP at check time and to loopback, private or cloud metadata addresses at delivery time.","category":"ai-tooling","nicknames":[],"who_cares":["python","praisonai","self-hosted","cloud"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Server makes requests to internal services and cloud metadata endpoints","analyst_note":"","how_to_check":"- Check the installed PraisonAI version with `pip show praisonai` and see whether it is in the range 4.5.126 up to but not including 4.6.59.\n- Check whether the Async Jobs API is exposed and accepts `webhook_url` in job requests.","needs_analyst":false,"not_affected_if":["patched-4.6.59-or-later","async-jobs-disabled"],"who_is_affected":"Teams running PraisonAI from 4.5.126 before 4.6.59 with the Async Jobs API enabled and reachable by users who can submit webhook URLs. Deployments where only trusted operators can create jobs have less exposure. Teams on 4.6.59 or later are not affected by this report.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":3495,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-57114':14A,17A '4.5.126':88C '4.6.59':92C,211C '8frj':201C '8q3m':202C 'actual':50B 'address':74B 'agent':83C 'ai':19B 'ai-tool':18B 'api':31B,97C 'appear':190C 'async':29B,95C 'attack':53B,157C 'attacker-control':156C 'block':118C 'bound':126C 'bypass':4A,180C,197C 'check':32B,42B,65B 'cloud':21B,72B 'complet':135C 'construct':115C 'control':158C 'current':186C 'cve':12A,15A 'deliveri':76B,178C 'direct':119C 'dns':2A 'enforc':45B 'fix':195C 'ghsa':200C 'ghsa-8frj-8q3m-xhgm':199C 'guard':6A,153C,184C 'host':26B 'hostnam':57B,141C,159C 'httpx.asyncclient.post':143C 'incomplet':194C 'infrastructur':175C 'intend':182C 'intern':8A,111C 'ip':63B,150C,166C 'issu':205C 'job':30B,37B,96C,103C,112C,134C 'later':129C,171C 'loopback':69B 'loopback/private':120C 'loopback/private/cloud-metadata':174C 'metadata':11A,73B 'multi':82C 'multi-ag':81C 'network':9A,130C 'object':113C 'origin':140C 'pars':106C 'pass':138C 'patch':196C,208C 'pin':151C 'praisonai':1A,22B,27B,78C,93C 'privat':70B 'public':62B,165C 'pydant':168C 'python':23B 'reach':7A 'rebind':3A 'releas':188C 'request':104C,131C 'resolv':59B,162C,172C 'self':25B 'self-host':24B 'send':136C,147C 'send-tim':146C 'sent':51B 'ssrf':183C 'submit':39B 'support':187C 'system':85C 'target':121C 'team':84C 'therefor':161C 'time':66B,77B,148C 'tool':20B 'transport':154C 'url':34B,100C 'use':55B 'valid':98C,117C,149C,169C 'version':87C,91C,210C 'webhook':5A,33B,48B,99C,137C,177C 'xhgm':203C","nicknames":[],"mitigations":[],"who_affected":"Teams running PraisonAI from 4.5.126 before 4.6.59 with the Async Jobs API enabled and reachable by users who can submit webhook URLs. Deployments where only trusted operators can create jobs have less exposure. Teams on 4.6.59 or later are not affected by this report.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57114","severity":null,"published_at":"2026-10-23T13:17:10+00:00","modified_at":"2026-10-23T13:17:10+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-57114","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57114","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}