CVE-2026-55525 PraisonAI: SSRF via redirect-following in praisonaiagents web_crawl
Attackers can exploit redirect handling in PraisonAI's web_crawl to access internal network resources and cloud metadata, bypassing local crawl restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55525?
CVE-2026-55525 is a high-severity server-side request forgery vulnerability in MervinPraison PraisonAI, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.
Weakness: CWE-918
Which versions are affected by CVE-2026-55525?
3 open source packages ship an affected version, including praisonaiagents.
| Package | Affected | Fixed in |
|---|---|---|
praisonaiagents PyPI | All versions | 1.6.58 |
praisonaiagents PyPI | All versions | 1.6.58 |
praisonaiagents PyPI | All versions | 1.6.58 |
How do I fix CVE-2026-55525?
Upgrade praisonaiagents to 1.6.58 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-55525 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55525 exists.
Sources
Also known as GHSA-5r34-2g38-6569, PYSEC-2026-3898.