PT-2026-61768 · Praisonai · Praisonai
CVE-2026-57114
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
praisonai versions 4.5.126 through 4.6.57
Description
The Async Jobs API contains a Server-Side Request Forgery (SSRF) flaw that can be triggered via DNS rebinding. While the API validates the
webhook url during request parsing and object construction to block private or loopback targets, this validation is not bound to the actual network request. An attacker can provide a hostname that resolves to a public IP during validation but resolves to a private, loopback, or cloud-metadata address when the send webhook() function is called. This allows an attacker to send POST requests to internal infrastructure, perform internal port probing, or interact with cloud metadata endpoints.Technical details include:
- API Endpoint:
POST /api/v1/runs - Vulnerable Parameter:
webhook url - Vulnerable Functions:
JobSubmitRequest.validate webhook url(),Job.validate webhook url(), andJobExecutor. send webhook()
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary mitigation, restrict access to the
POST /api/v1/runs endpoint or implement mandatory authentication for job submissions to prevent unauthorized users from specifying a webhook url.Time Of Check To Time Of Use
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai