high7.2
CVE-2026-60091
PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint.
Impact
PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | praisonai | <= 4.6.77 | 4.6.78 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-4w49-gwv8-fpjg
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4w49-gwv8-fpjg
- https://nvd.nist.gov/vuln/detail/CVE-2026-60091
- https://nvd.nist.gov/vuln/detail/CVE-2026-62175
- https://www.vulncheck.com/advisories/praisonai-before-unauthenticated-ssrf-via-webhook-url