PT-2026-57436 · Praisonai+2 · Praisonai+2

Dinhvaren · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-61429

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.78

Description A server-side request forgery (SSRF) issue exists in the Crawl4AI/Chromium backend. This flaw allows attackers to bypass SSRF validation by utilizing DNS rebinding and HTTP redirects. By crafting specific URLs that resolve to internal services after the initial validation, an attacker can force the headless browser to follow redirects and read internal responses, which may include sensitive canary values.

Recommendations Update PraisonAI to version 1.6.78 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-61429

Affected Products

Chromium

Crawl4Ai

Praisonai

References · 6

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g59-gm2v-qhvq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61429 · Security Note
• https://twitter.com/CVEnew/status/2075976717840105673 · Twitter Post
• https://vulncheck.com/advisories/praisonai-before-ssrf-via-crawl4ai-chromium-backend · Note
• https://reddit.com/r/pwnhub/comments/1utx5h2/praisonai_ssrf_vulnerability_allows_access_to · Reddit Post
• https://twitter.com/infoflowcloud/status/2075977423166779758 · Twitter Post