PT-2026-60136 · Mervinpraison · Praisonai

Dinhvaren · Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-61430

Mitre

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-61430

Produtos afetados

Praisonai

Referências · 3

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qg25-6gc4-48mg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-61430 · Nota de Segurança
• https://vulncheck.com/advisories/praisonai-before-dns-rebinding-ssrf-via-web-crawl · Nota