CVE-2026-61430 MervinPraison CVE debrief

Who should care

Defenders responsible for PraisonAI deployments should assess exposure and prioritize verification and remediation efforts. This vulnerability is particularly relevant for environments where agents can crawl URLs influenced by external actors.

Why it matters

This vulnerability allows for SSRF with internal response disclosure (read-back) in PraisonAI's `web_crawl` agent tool. Defenders should prioritize verifying the affected version, monitoring for suspicious URLs, and implementing additional security measures to prevent SSRF attacks. The vulnerability is particularly relevant for environments where agents can crawl URLs influenced by external actors.

• Internal response disclosure to unauthorized actors
• Potential for sensitive information exposure
• Bypass of SSRF protections in certain scenarios
• Need for verification of affected versions and remediation

Technical summary

The `_is_safe_crawl_url()` function in PraisonAI's `web_crawl` agent tool resolves the hostname and rejects private/loopback/link-local IPs at validation time. However, the fetch backend re-resolves the hostname at connection time, allowing a DNS-rebinding domain to bypass the guard and return the internal HTTP response body to the caller. This vulnerability is reachable by any actor who can influence the URL an agent crawls. The vulnerability was runtime-confirmed against PraisonAI 4.6.63, and the crawl response returned controlled internal markers `PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91` / `FAKE_INTERNAL_TOKEN_DO_NOT_USE_7f3a91`.

Defensive priority

Defenders should prioritize verifying the affected version of PraisonAI and upgrading to a fixed version if necessary. They should also monitor for and restrict suspicious URLs that could be used for DNS rebinding attacks.

Recommended defensive actions

• Verify the version of PraisonAI and upgrade to a fixed version if necessary
• Monitor for and restrict suspicious URLs that could be used for DNS rebinding attacks
• Implement additional security measures to prevent SSRF attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was runtime-confirmed against PraisonAI 4.6.63. The crawl response returned controlled internal markers `PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91` / `FAKE_INTERNAL_TOKEN_DO_NOT_USE_7f3a91`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.