{"cve":"CVE-2026-40160","nvd":{"published":"2026-04-10T17:17:13.950","modified":"2026-10-26T21:10:00.170","status":"Analyzed","description":"PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-918"],"references":["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qq9r-63f6-v542","https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qq9r-63f6-v542"],"products":["praison:praisonaiagents"],"source":"nvd","synced_at":"2026-10-26T21:38:48.864438205+00:00"},"epss":{"cve":"CVE-2026-40160","score":0.00464,"percentile":0.39953,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-qq9r-63f6-v542","url":"https://osv.dev/vulnerability/GHSA-qq9r-63f6-v542","summary":"PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback","modified":"2026-07-13T16:43:49.773164587Z","packages":[{"ecosystem":"PyPI","name":"praisonaiagents","purl":"pkg:pypi/praisonaiagents","ranges":[">=0.13.23 <1.5.128"],"fixed":["1.5.128"]}]},{"id":"PYSEC-2026-2951","url":"https://osv.dev/vulnerability/PYSEC-2026-2951","summary":"PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback","modified":"2026-07-13T16:31:53.940698897Z","packages":[{"ecosystem":"PyPI","name":"praisonaiagents","purl":"pkg:pypi/praisonaiagents","ranges":[">=0.13.23 <1.5.128"],"fixed":["1.5.128"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}