{"id":"CVE-2026-57114","aliases":[],"cve":{"records":[{"id":"CVE-2026-57114","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-24T00:33:17.706Z","published":"2026-10-23T12:04:29.966Z","modified":"2026-10-29T13:09:28.257Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-23T12:04:29.966Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T13:09:28.257Z"}],"references":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rjvw-7vvw-549v","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rjvw-7vvw-549v","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-367","description":"CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","source":"GitHub_M"},{"id":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T13:09:05.011091Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, _send_webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm. This issue has been patched in version 4.6.59.","score":7.2,"severity":"high","published":"2026-10-23T12:04:29.966Z","modified":"2026-10-29T13:09:28.257Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"MervinPraison","name":"PraisonAI","platforms":[],"versions":[{"version":">= 4.5.126, < 4.6.59","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-57114"}],"remediation":[],"references":["https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rjvw-7vvw-549v"],"sources":[{"name":"CVE","id":"CVE-2026-57114","modified":"2026-10-29T13:09:28.257Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-57114"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","score":7.2}],"sourceAffected":[],"observedAt":"2026-10-29T14:16:08.588Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T05:40:30.632Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"PraisonAI versions 4.5.126 to 4.6.59 are vulnerable to a Server-Side Request Forgery (SSRF) protection bypass via DNS rebinding, allowing an attacker to resolve an attacker-controlled hostname to a private target. The weakness is due to a Time-of-check Time-of-use (TOCTOU) Race Condition. An attacker with control over a hostname can exploit this vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:16:44.762Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-57114"}]}}