CVE-2026-40160 HIGH

CVE-2026-40160: PraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallback

Vendor Mervinpraison
Product PraisonAIAgents
Weakness CWE-918 · SSRF
Published April 10, 2026
Last update April 13, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N

What the vulnerability does

01Description

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128.

Key dates

02Disclosure timeline

April 10, 2026 CVE published
April 13, 2026 Record updated