PT-2026-38305 · Praisonai · Praisonai

Fushuling + 1 · Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-44335

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.32

Description A logical flaw in the URL checking logic allows attackers to bypass security filters, leading to Server-Side Request Forgery (SSRF). The system uses the validate url() function to perform security checks on the host portion of a URL extracted by urlparse(). However, a discrepancy exists between how urlparse() and the requests library parse certain URLs. For example, in a URL like http://127.0.0.1:6666@1.1.1.1, urlparse() identifies the hostname as 1.1.1.1 (a public address), while requests interprets it as 127.0.0.1 (an internal address). This inconsistency allows requests to be routed to internal network addresses despite passing the initial validation.

Recommendations Update to version 1.6.32.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-44335

GHSA-Q9PW-VMHH-384G

Affected Products

Praisonai

References · 7

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q9pw-vmhh-384g · Exploit
• https://osv.dev/vulnerability/GHSA-q9pw-vmhh-384g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44335 · Security Note
• https://github.com/MervinPraison/PraisonAI · Note
• https://twitter.com/lyrie_ai/status/2054795487685853619 · Twitter Post
• https://twitter.com/infoflowcloud/status/2052812499947266418 · Twitter Post
• https://twitter.com/CVEnew/status/2052811061049405759 · Twitter Post