CVE-2026-57114 PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-57114?
CVE-2026-57114 is a high-severity vulnerability in MervinPraison PraisonAI, published on 23 Oct 2026.
Official description
PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, _send_webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm. This issue has been patched in version 4.6.59.
Which versions are affected by CVE-2026-57114?
3 open source packages ship an affected version, including praisonai.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | From 4.5.126 | 4.6.59 |
praisonai PyPI | From 4.5.126 | 4.6.59 |
praisonai PyPI | From 4.5.126 | 4.6.59 |
How do I fix CVE-2026-57114?
Upgrade praisonai to 4.6.59 or later.
Is CVE-2026-57114 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57114 exists.
Sources
Also known as GHSA-rjvw-7vvw-549v, PYSEC-2026-3519.