CVE-2026-60091: PraisonAI SSRF in Jobs API — Unauthenticated Remote Vulnerability

Technical summary

The /api/v1/runs endpoint in the Jobs API accepts a webhook_url parameter without requiring authentication. While the endpoint performs validation on this parameter at request time, the actual DNS resolution and HTTP connection occur at a later point during webhook delivery. Attackers can exploit this time-of-check-time-of-use (TOCTOU) condition by registering a domain that initially resolves to an attacker-controlled IP, passing validation, then rapidly changing DNS records to point to internal IP addresses (127.0.0.1, 192.168.x.x, 10.x.x.x) before the server establishes the connection. This blind SSRF attack allows reconnaissance and potential interaction with internal services such as metadata endpoints, database administration interfaces, or other backend systems not intended for external access. The attack requires no authentication and can be triggered remotely over the network.

Business impact

An attacker could leverage this vulnerability to discover and interact with internal services, potentially extracting sensitive information such as cloud metadata credentials, internal API keys, or database connection details. In cloud environments, this could lead to privilege escalation or lateral movement. The blind nature of the SSRF limits direct data exfiltration but enables reconnaissance and targeted attacks against internal infrastructure. Organizations running PraisonAI may have internal services exposed through this vector that are architecturally assumed to be unreachable from the internet.

Affected systems

PraisonAI versions prior to 4.6.78 are affected. Organizations using PraisonAI in production, particularly in environments where it has network access to internal services or cloud metadata endpoints, face exposure. The lack of an authentication requirement means any network-reachable instance is vulnerable to remote exploitation.

Exploitability

Exploitability is straightforward. The vulnerability requires only network access to the PraisonAI instance and the ability to control a DNS domain. No authentication, complex tooling, or user interaction is necessary. The DNS rebinding technique is well-understood in the security community. Once an attacker identifies a vulnerable PraisonAI deployment, they can craft requests to probe internal network ranges, cloud metadata services, or known internal infrastructure. The CVSS score of 7.2 reflects this ease of exploitation combined with the potential for information disclosure and integrity impacts.

Remediation

Upgrade PraisonAI to version 4.6.78 or later, which addresses the validation and resolution timing gap. Additionally, implement network segmentation to restrict PraisonAI's outbound access to only necessary external services; internal services should never be directly reachable from the Jobs API component. Use firewall rules to prevent the PraisonAI process from reaching private IP ranges or cloud metadata endpoints (169.254.169.254 in AWS, equivalent in other cloud providers). If running in containers, restrict network policies to deny egress to non-routable addresses.

Patch guidance

Apply the upgrade to version 4.6.78 as soon as possible given the low barrier to exploitation. The patch should be validated in a non-production environment first to ensure compatibility with dependent workflows. Since the vulnerability is in the Jobs API, test webhook delivery and job completion workflows after patching. Verify that legitimate webhook callbacks continue to function correctly.

Detection guidance

Monitor for HTTP requests from the PraisonAI process to unusual or internal IP addresses, particularly 127.0.0.1, 169.254.169.254, or private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Log all requests to the /api/v1/runs endpoint, especially those with webhook_url parameters pointing to domains with short TTLs or high DNS query rates—indicators of DNS rebinding attempts. If possible, instrument the Jobs API to log both the validated webhook URL and the actual resolved IP address; discrepancies suggest DNS rebinding. Watch for reconnaissance-like patterns: multiple requests with webhook_urls containing common metadata endpoints (e.g., http://169.254.169.254/latest/meta-data) or scanning of internal network ranges.

Why prioritize this

This vulnerability merits high priority because it is unauthenticated, remotely exploitable, and requires no user interaction. It directly threatens the confidentiality and integrity of internal infrastructure. While the severity is not critical (impact is mainly information disclosure), the ease of exploitation and the potential for lateral movement in cloud environments justify rapid patching. Organizations should treat this as a week-zero remediation if they expose PraisonAI to untrusted networks.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) is driven by: Network accessibility (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), no user interaction (UI:N), and scope change (S:C) meaning the vulnerability can affect resources beyond the vulnerable component. Confidentiality and integrity are impacted (C:L/I:L) through potential access to internal services and their data, though availability is not directly affected (A:N). The score appropriately reflects the ease of exploitation and the potential for sensitive information disclosure while acknowledging that direct remote code execution is not possible.

Frequently asked questions