CVE-2026-47390 MervinPraison CVE debrief

Who should care

Security teams and administrators responsible for PraisonAI deployments should be aware of this vulnerability and take steps to mitigate it. This vulnerability could allow an attacker to access sensitive information or disrupt services. Affected operators, platforms, and security teams should review the vulnerability and implement necessary controls.

Technical summary

The `spider_tools` URL validation function in PraisonAI is vulnerable to bypass due to weak validation. The function only blocks a small set of exact host strings such as `localhost` and `127.0.0.1`, but does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request. This allows an attacker to induce SSRF requests against loopback-only services. The vulnerability was patched in PraisonAI version 4.6.40 and praisonaiagents version 1.6.40.

Defensive priority

Medium

Recommended defensive actions

• Update PraisonAI to version 4.6.40 or later and praisonaiagents to version 1.6.40 or later.
• Restrict access to the PraisonAI system to trusted users and networks.
• Monitor for suspicious activity and implement additional security measures to detect and prevent SSRF attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-21T16:17:11.760Z and was last modified on 2026-07-22T15:17:17.097Z. The NVD entry is currently Deferred. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The PraisonAI system uses a multi-agent teams system, and the vulnerability exists in the `spider_tools` URL validation function. The function can be bypassed using alternate loopback host encodings, allowing an attacker to induce SSRF requests against loopback-only services.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.