External risk intelligence

PraisonAI SSRF Vulnerability via Webhook URL

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-40114

PraisonAI is a multi-agent system designed with an API component (/api/v1/runs) that is reachable by users. As a service-oriented application exposing web API endpoints, it is commonly deployed in environments where such interfaces are accessible to clients, making the vulnerable surface likely to be exposed in real-world deployment patterns.

Server-Side Request Forgery

Praisonai

before 4.5.128

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in PraisonAI allows unauthenticated attackers to redirect server requests to arbitrary internal or external destinations, potentially exposing sensitive cloud or internal service data. The issue lies in how the system handles webhook URLs without sufficient validation, enabling server-side request forgery. This could impact systems that integrate with PraisonAI, depending on its deployment and network access.

Server requests can be redirected.
Enables unauthorized access to internal services.
Confirm relevance and exposure of this system.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can send specially crafted requests to the PraisonAI's `/api/v1/runs` endpoint, causing the server to issue POST requests to arbitrary URLs. This capability allows the attacker to interact with internal systems or cloud metadata services, potentially leading to further compromise.

Attacker needs network access.
Vulnerable endpoint accepts arbitrary URLs.
Risk of internal system exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to trick the PraisonAI server into sending HTTP POST requests to arbitrary internal or external destinations. This could potentially expose sensitive information or allow for further attacks against network-adjacent services, such as cloud metadata services or internal APIs.

Internal network services and cloud metadata.
Server sends POST requests to attacker-controlled URLs.
Unauthorized access to internal resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI system, specifically the `/api/v1/runs` endpoint, is susceptible to Server-Side Request Forgery (SSRF). Teams responsible for managing the PraisonAI application, alongside infrastructure and security teams, should prioritize identifying all instances of this software. Once located, confirm exposure, assess business criticality, and then coordinate remediation efforts, potentially involving vendor liaison for updates.

Application and platform teams own the issue.
Verify external reachability and criticality.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a software framework designed to manage and orchestrate multi-agent teams. It provides an API, including endpoints like /api/v1/runs, that allows users to initiate and monitor automated tasks. By functioning as a service-oriented application, it helps developers build systems where multiple AI agents work together to execute jobs or workflows.

What does CWE-918 mean for CVE-2026-40114?

CWE-918 refers to Server-Side Request Forgery (SSRF). In this specific vulnerability, the application fails to validate the webhook URLs provided in job requests. Because it lacks these checks, an attacker can manipulate the server into making unauthorized HTTP POST requests to destinations of the attacker's choosing, rather than intended service endpoints.

How is this SSRF vulnerability triggered?

An attacker triggers this by sending a crafted request to the /api/v1/runs endpoint containing an arbitrary webhook_url. When the server processes the job completion, it automatically attempts to contact that URL. Importantly, valid job execution or specific internal networking configurations are not required to initiate the request; the server will attempt to connect to any URL provided in the input.

Do I need to worry if my PraisonAI instance is internal?

Halo Surface Signal indicates that because PraisonAI exposes web API endpoints for clients, it is frequently deployed where those interfaces are reachable. Even if an instance is not public-facing, it remains at risk if an attacker has any network access to the API. You should determine if your specific deployment allows network-adjacent traffic to reach this endpoint.

When should I apply the update for this issue?

You should prioritize updating to version 4.5.128 or later immediately. Since this vulnerability allows unauthorized interaction with your internal network and cloud infrastructure, identifying all instances of PraisonAI within your environment is the recommended first step. Once identified, confirm your exposure level and coordinate the update process with your application and infrastructure teams.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8frj…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.