CVE-2026-40160 PraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallback
Attackers can force AI agents to crawl internal URLs, exposing cloud metadata and internal services via unvalidated httpx requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40160?
CVE-2026-40160 is a high-severity server-side request forgery vulnerability in MervinPraison PraisonAIAgents, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128.
Weakness: CWE-918
Which versions are affected by CVE-2026-40160?
3 open source packages ship an affected version, including praisonaiagents. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
praisonaiagents PyPI | From 0.13.23 | 1.5.128 |
praisonaiagents PyPI | From 0.13.23 | 1.5.128 |
praisonaiagents PyPI | From 0.13.23 | 1.5.128 |
Products include Praison Praisonaiagents.
How do I fix CVE-2026-40160?
Upgrade praisonaiagents to 1.5.128 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-40160 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40160 exists.
Other vulnerabilities in MervinPraison PraisonAIAgents
- CVE-2026-34938 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
- CVE-2026-40111 PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
- CVE-2026-34954 PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL
- CVE-2026-34937 PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
- CVE-2026-44335 SSRF bypass in PraisonAI
Sources
Also known as GHSA-qq9r-63f6-v542, PYSEC-2026-2951.