CVE-2026-40160
published 2026-04-10CVE-2026-40160: PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get()…
PriorityP335medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EPSS
0.28%
19.8th percentile
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mervinpraison | praisonaiagents | < 1.5.128 | 1.5.128 |
| mervinpraison | praisonaiagents | >= 0.13.23 < 1.5.128 | 1.5.128 |
| praison | praisonaiagents | < 1.5.128 | 1.5.128 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
ghsa·2026-04-10
CVE-2026-40160 [HIGH] CWE-918 PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
PraisonAIAgents: SSRF via unvalidated URL in `web_crawl` httpx fallback
| Field | Value |
|---|---|
| Severity | High |
| Type | SSRF -- unvalidated URL in `web_crawl` httpx fallback allows internal network access |
| Affected | `src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:133-180` |
## Summary
`web_crawl`'s httpx fallback path passes user-supplied URLs directly to `httpx.AsyncClient.get()` with `follow_redirects=True` and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (`169.254.169.254`), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker.
This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no C
VulDB
MervinPraison PraisonAIAgents up to 1.5.127 httpx.AsyncClient.get server-side request forgery (GHSA-qq9r-63f6-v542)
vuldb·2026-04-10·CVSS 7.1
CVE-2026-40160 [HIGH] MervinPraison PraisonAIAgents up to 1.5.127 httpx.AsyncClient.get server-side request forgery (GHSA-qq9r-63f6-v542)
A vulnerability was found in MervinPraison PraisonAIAgents up to 1.5.127. It has been declared as critical. This affects the function httpx.AsyncClient.get. Executing a manipulation can lead to server-side request forgery.
This vulnerability appears as CVE-2026-40160. The attack may be performed from remote. There is no available exploit.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-10
Published