CVE-2026-47390— PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mervin Praison PraisonAI是Mervin Praison个人开发者开源的一个低代码多智能体协作框架。 Mervin Praison PraisonAI 4.6.40之前版本存在服务端请求伪造漏洞，该漏洞源于spider_tools URL验证绕过，可能导致服务端请求伪造攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MervinPraison | PraisonAI | < 4.6.40 |
affected |
| MervinPraison | praisonaiagents | < 1.6.40 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47390
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `spider_tools` URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as `localhost` and `127.0.0.1`. It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request. As a result, certain URLs may bypass the protection and still reach loopback services. After the weak validation passes, `scrape_page()` calls `requests.Session.get()` on the attacker-controlled URL. This allows an attacker who can influence URLs passed to `scrape_page`, `crawl`, or `extract_text` to induce SSRF requests against loopback-only services. This is a server-side request forgery protection bypass. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Mervin Praison PraisonAI 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mervin Praison PraisonAI是Mervin Praison个人开发者开源的一个低代码多智能体协作框架。 Mervin Praison PraisonAI 4.6.40之前版本存在服务端请求伪造漏洞，该漏洞源于spider_tools URL验证绕过，可能导致服务端请求伪造攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | < 4.6.40 | - |
|
| MervinPraison | praisonaiagents | < 1.6.40 | - |
|
II. Public POCs for CVE-2026-47390
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47390
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47390 (1)
Same Patch Batch · MervinPraison · 2026-07-21 · 25 CVEs total
| CVE-2026-47392 | 9.9 CRITICAL | PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execu |
| CVE-2026-47393 | 9.8 CRITICAL | PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default |
| CVE-2026-47396 | 9.8 CRITICAL | PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when |
| CVE-2026-47391 | 9.8 CRITICAL | PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool e |
| CVE-2026-47410 | 9.8 CRITICAL | praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing |
| CVE-2026-47413 | 9.6 CRITICAL | praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspa |
| CVE-2026-47416 | 9.6 CRITICAL | praisonai-platform: Any workspace member can promote themselves (or any other member) to o |
| CVE-2026-47405 | 8.8 HIGH | PraisonAI Platform missing role checks let any workspace member become owner and take over |
| CVE-2026-47399 | 8.8 HIGH | PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global o |
| CVE-2026-47415 | 8.3 HIGH | praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, |
| CVE-2026-47419 | 8.3 HIGH | praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, |
| CVE-2026-47417 | 8.1 HIGH | praisonai-platform: Comment endpoints accept any issue_id without workspace ownership chec |
| CVE-2026-47412 | 8.1 HIGH | praisonai-platform: Any workspace member can delete the entire workspace via DELETE /works |
| CVE-2026-47418 | 8.1 HIGH | praisonai-platform: Project endpoints accept any project_id without workspace ownership ch |
| CVE-2026-47409 | 8.1 HIGH | praisonai-platform: Any workspace member can remove any other member (including the owner) |
| CVE-2026-47406 | 8.1 HIGH | praisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace |
| CVE-2026-47398 | 8.1 HIGH | PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_gen |
| CVE-2026-47414 | 7.6 HIGH | praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace |
| CVE-2026-47397 | 7.1 HIGH | PraisonAI has an Arbitrary File Write in Python API |
| CVE-2026-47408 | 6.5 MEDIUM | praisonai-platform: list_issue_activity returns activity log for any issue regardless of w |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-55524
PraisonAI: SSRF in web_crawl tool via redirect-following and -
CVE-2026-55523
PraisonAI has a`web_crawl` SSRF protection bypass via unchec -
CVE-2026-55522
PraisonAI workflow include bypasses tools.py autoload opt-in -
CVE-2026-48168
PraisonAI: GitHub Actions Claude workflow command injection -
CVE-2026-47398
PraisonAI: Arbitrary code execution via unguarded `spec.load
Same vendor: MervinPraison
-
CVE-2026-48169
PraisonAI has Cross-Workspace IDOR and Privilege Escalation -
CVE-2026-55524
PraisonAI: SSRF in web_crawl tool via redirect-following and -
CVE-2026-55523
PraisonAI has a`web_crawl` SSRF protection bypass via unchec -
CVE-2026-55522
PraisonAI workflow include bypasses tools.py autoload opt-in -
CVE-2026-48168
PraisonAI: GitHub Actions Claude workflow command injection
Same weakness: CWE-918
-
CVE-2026-78061
vas3k TaxHacker Email Sync imap-client.ts buildImapConfig se -
CVE-2026-63311
NLTK before 3.10.0 SSRF via DNS Resolution Failure -
CVE-2026-78003
Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side -
CVE-2026-53509
@aborruso/ckan-mcp-server: SSRF via base_url allows access t -
CVE-2026-50288
@asymmetric-effort/specifyjs: URL parse failure silently all
V. Comments for CVE-2026-47390
No comments yet