CVE-2026-55524 MervinPraison CVE debrief

Who should care

Users of PraisonAI versions prior to 1.6.58, especially those with exposed web_crawl functionality, should prioritize upgrading to mitigate potential SSRF attacks. This includes operators, platform administrators, vulnerability management teams, and security teams who may be impacted by the vulnerability.

Technical summary

The web_crawl tool in PraisonAI versions prior to 1.6.58 is vulnerable to SSRF attacks due to insufficient hostname validation, allowing potential access to internal and cloud metadata endpoints. This vulnerability is caused by the tool's SSRF check only on the initially supplied URL, which can be bypassed through HTTP redirects and DNS rebinding. The issue can be mitigated by upgrading to version 1.6.58 or later and implementing additional SSRF protections.

Defensive priority

Organizations using PraisonAI versions prior to 1.6.58 should prioritize upgrading to mitigate potential SSRF attacks.

Recommended defensive actions

• Upgrade to PraisonAI version 1.6.58 or later
• Review and restrict URLs passed to web_crawl()
• Implement additional SSRF protections
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The web_crawl tool in PraisonAI versions prior to 1.6.58 performs SSRF checks only on the initially supplied URL, allowing potential bypass through HTTP redirects and DNS rebinding. This issue may impact organizations using PraisonAI for web crawling tasks, as it could lead to unauthorized access to internal or cloud metadata endpoints. Defenders should verify the affected scope, review source code for similar vulnerabilities, and ensure proper validation of URLs passed to web_crawl().

Official resources