CVE-2026-61430

EUVD-2026-44639
PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.5 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qg25-6gc4-48mg
https://www.vulncheck.com/advisories/praisonai-before-dns-rebinding-ssrf-via-web-crawl
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qg25-6gc4-48mg