PT-2026-60136 · Mervinpraison · Praisonai

Dinhvaren · Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-61430

Mitre

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-61430

Affected Products

Praisonai

References · 3

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qg25-6gc4-48mg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-61430 · Security Note
• https://vulncheck.com/advisories/praisonai-before-dns-rebinding-ssrf-via-web-crawl · Note