CVE-2026-40160
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost, and the response content is returned to the agent and may appear in output visible to the attacker.
Risk Assessment
An attacker could leverage the LLM agent to access internal services and cloud metadata, potentially leading to leakage of credentials or configuration data. The default crawl path on a fresh installation increases exposure.
Recommendation
Upgrade PraisonAIAgents to version 1.5.128 or later. Implement host validation and block internal and metadata addresses in outbound requests.
Other vulnerabilities in PraisonAIAgents
See all- CVE-2026-57123Critical
In praisonaiagents prior to 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding.
- CVE-2026-57129High
In praisonaiagents prior to 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.
- CVE-2026-57126High
In praisonaiagents prior to 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.
- CVE-2026-40152Medium
PraisonAIAgents prior to 1.5.128 contains a vulnerability in the list_files() tool in FileTools. The pattern parameter is passed directly to Path.glob() without validation, allowing relative path traversal to enumerate arbitrary files outside the workspace and obtain file metadata.
- CVE-2026-40117Medium
In PraisonAIAgents prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem via an unrestricted skill_path parameter. Unlike other functions, it enforces neither workspace boundary confinement nor critical-level approval.
Original NVD description (English source)
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS