CVE-2026-61429
PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend
PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend
PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.
- Record
CVE-2026-61429- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2026-43178
PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.
- Record
EUVD-2026-43178- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6g59-gm2v-qhvq
PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
Summary
The DNS-rebinding / redirect SSRF bypass in PRAI-05 is not limited to the httpx/urllib backend. When crawl4ai (headless Chromium via Playwright) is installed, web_crawl auto-selects provider=crawl4ai, and the headless browser re-resolves DNS and follows redirects on its own — with no per-connection SSRF guard. Runtime-confirmed read-back of the internal canary via both DNS rebinding and redirect (provider: "crawl4ai"). Status: runtime-confirmed addendum to PRAI-05.
Details
Affected component
- Package
praisonaiagents4.6.63. Backend selected whencrawl4ai+Playwright are installed. - Files:
src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py(_crawl_with_crawl4ai) andsrc/praisonai-agents/praisonaiagents/tools/crawl4ai_tools.py(standalone crawl wrappers).
Vulnerable code / root cause
Path:
src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py
Function:
_crawl_with_crawl4ai
Snippet:
async with AsyncWebCrawler() as crawler:
for url in urls:
result = await crawler.arun(url=url) # headless browser: re-resolves DNS, follows redirects
Path:
src/praisonai-agents/praisonaiagents/tools/crawl4ai_tools.py
Function:
Crawl4AITools.crawl / crawl4ai
Snippet:
result = await crawler.arun(url=url, config=config) # no _is_safe_crawl_url / no per-connect validation
Issue: the only SSRF check is the single pre-fetch _is_safe_crawl_url() on the initial URL string in web_crawl() (see PRAI-05). The headless browser then resolves and connects independently and follows redirects in-browser — no resolved-IP pinning, no per-hop/per-connect validation. Input (urls) is attacker/agent-controlled; the sink is crawler.arun(url=...); the guard is bypassed by DNS rebinding (TOCTOU) and by redirects (followed in-browser).
Attack flow / Why bypassed / Security boundary
Identical to PRAI-05: TOCTOU between the guard's resolution and the browser's connection; redirects followed in-browser; internal response returned as crawl content. See PRAI-05.
Proof of Concept
Environment
crawl4ai + Playwright Chromium installed in a dedicated runtime container (127.0.0.1:18081), same controlled internal canary + rebinding DNS. Runnable assets: PraisonAI-Runtime-Repro\runtime-files\ (docker-compose.crawl.yml).
Steps to reproduce
SSRF-04-01-Crawl4AI-DNS-Rebind-Trigger→127.0.0.1:18081:
POST /tool/web_crawl HTTP/1.1
Host: 127.0.0.1:18081
Content-Type: application/json
{"url":"http://rebind.lab:8081/secret"}
- Redirect variant
SSRF-04-03-Crawl4AI-Redirect-Readback:{"url":"http://redirector:8082/redirect-to-internal"}.
Expected result
The crawl backend refuses internal destinations regardless of DNS timing/redirects.
Actual result
HTTP 200, "provider":"crawl4ai", response content contains PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91 + FAKE_INTERNAL_TOKEN_DO_NOT_USE_7f3a91 for both the DNS-rebinding and the redirect payload.
Screenshots
Crawl4AI DNS rebinding read-back
The attacker-controlled rebind.lab URL is accepted by the Crawl4AI-backed web_crawl endpoint. PraisonAI returns the internal canary response body containing PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91.
<img width="1542" height="763" alt="01-Crawl4AI-Burp-Readback" src="https://github.com/user-attachments/assets/a03b3a1c-e382-4f67-8ea6-b766dceb4a69" />
Crawl4AI DNS rebinding runtime evidence
The runtime log shows the Crawl4AI/Chromium backend resolving rebind.lab to an internal Docker IP during the fetch phase. The internal canary receives GET /secret from a headless Chrome user agent.
<img width="1659" height="946" alt="02-Crawl4AI-DNS-Log-And-Internal-Hit" src="https://github.com/user-attachments/assets/d93db090-3e39-43d0-af3b-5d1d8f614db8" />
Crawl4AI redirect read-back
The attacker-controlled redirector URL is accepted by the Crawl4AI-backed endpoint. PraisonAI follows the…
- Record
GHSA-6g59-gm2v-qhvq- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-200, CWE-367, CWE-918
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rc3q-9pxg-3jhr
Duplicate Advisory: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6g59-gm2v-qhvq. This link is maintained to preserve external references.
Original Description
PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.
- Record
GHSA-rc3q-9pxg-3jhr- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.
- Record
CVE-2026-61429- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-6g59-gm2v-qhvq
PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
Summary
The DNS-rebinding / redirect SSRF bypass in PRAI-05 is not limited to the httpx/urllib backend. When crawl4ai (headless Chromium via Playwright) is installed, web_crawl auto-selects provider=crawl4ai, and the headless browser re-resolves DNS and follows redirects on its own — with no per-connection SSRF guard. Runtime-confirmed read-back of the internal canary via both DNS rebinding and redirect (provider: "crawl4ai"). Status: runtime-confirmed addendum to PRAI-05.
Details
Affected component
- Package
praisonaiagents4.6.63. Backend selected whencrawl4ai+Playwright are installed. - Files:
src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py(_crawl_with_crawl4ai) andsrc/praisonai-agents/praisonaiagents/tools/crawl4ai_tools.py(standalone crawl wrappers).
Vulnerable code / root cause
Path:
src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py
Function:
_crawl_with_crawl4ai
Snippet:
async with AsyncWebCrawler() as crawler:
for url in urls:
result = await crawler.arun(url=url) # headless browser: re-resolves DNS, follows redirects
Path:
src/praisonai-agents/praisonaiagents/tools/crawl4ai_tools.py
Function:
Crawl4AITools.crawl / crawl4ai
Snippet:
result = await crawler.arun(url=url, config=config) # no _is_safe_crawl_url / no per-connect validation
Issue: the only SSRF check is the single pre-fetch _is_safe_crawl_url() on the initial URL string in web_crawl() (see PRAI-05). The headless browser then resolves and connects independently and follows redirects in-browser — no resolved-IP pinning, no per-hop/per-connect validation. Input (urls) is attacker/agent-controlled; the sink is crawler.arun(url=...); the guard is bypassed by DNS rebinding (TOCTOU) and by redirects (followed in-browser).
Attack flow / Why bypassed / Security boundary
Identical to PRAI-05: TOCTOU between the guard's resolution and the browser's connection; redirects followed in-browser; internal response returned as crawl content. See PRAI-05.
Proof of Concept
Environment
crawl4ai + Playwright Chromium installed in a dedicated runtime container (127.0.0.1:18081), same controlled internal canary + rebinding DNS. Runnable assets: PraisonAI-Runtime-Repro\runtime-files\ (docker-compose.crawl.yml).
Steps to reproduce
SSRF-04-01-Crawl4AI-DNS-Rebind-Trigger→127.0.0.1:18081:
POST /tool/web_crawl HTTP/1.1
Host: 127.0.0.1:18081
Content-Type: application/json
{"url":"http://rebind.lab:8081/secret"}
- Redirect variant
SSRF-04-03-Crawl4AI-Redirect-Readback:{"url":"http://redirector:8082/redirect-to-internal"}.
Expected result
The crawl backend refuses internal destinations regardless of DNS timing/redirects.
Actual result
HTTP 200, "provider":"crawl4ai", response content contains PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91 + FAKE_INTERNAL_TOKEN_DO_NOT_USE_7f3a91 for both the DNS-rebinding and the redirect payload.
Screenshots
Crawl4AI DNS rebinding read-back
The attacker-controlled rebind.lab URL is accepted by the Crawl4AI-backed web_crawl endpoint. PraisonAI returns the internal canary response body containing PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91.
<img width="1542" height="763" alt="01-Crawl4AI-Burp-Readback" src="https://github.com/user-attachments/assets/a03b3a1c-e382-4f67-8ea6-b766dceb4a69" />
Crawl4AI DNS rebinding runtime evidence
The runtime log shows the Crawl4AI/Chromium backend resolving rebind.lab to an internal Docker IP during the fetch phase. The internal canary receives GET /secret from a headless Chrome user agent.
<img width="1659" height="946" alt="02-Crawl4AI-DNS-Log-And-Internal-Hit" src="https://github.com/user-attachments/assets/d93db090-3e39-43d0-af3b-5d1d8f614db8" />
Crawl4AI redirect read-back
The attacker-controlled redirector URL is accepted by the Crawl4AI-backed endpoint. PraisonAI follows the…
- Record
GHSA-6g59-gm2v-qhvq- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-200, CWE-367, CWE-918
- Updated
- 2026-11-02
OSVGHSA-rc3q-9pxg-3jhr
Duplicate Advisory: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6g59-gm2v-qhvq. This link is maintained to preserve external references.
Original Description
PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.
- Record
GHSA-rc3q-9pxg-3jhr- CVSS 4.0
- 8.4 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVPYSEC-2026-4269
PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
Summary
The DNS-rebinding / redirect SSRF bypass in PRAI-05 is not limited to the httpx/urllib backend. When crawl4ai (headless Chromium via Playwright) is installed, web_crawl auto-selects provider=crawl4ai, and the headless browser re-resolves DNS and follows redirects on its own — with no per-connection SSRF guard. Runtime-confirmed read-back of the internal canary via both DNS rebinding and redirect (provider: "crawl4ai"). Status: runtime-confirmed addendum to PRAI-05.
Details
Affected component
- Package
praisonaiagents4.6.63. Backend selected whencrawl4ai+Playwright are installed. - Files:
src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py(_crawl_with_crawl4ai) andsrc/praisonai-agents/praisonaiagents/tools/crawl4ai_tools.py(standalone crawl wrappers).
Vulnerable code / root cause
Path:
src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py
Function:
_crawl_with_crawl4ai
Snippet:
async with AsyncWebCrawler() as crawler:
for url in urls:
result = await crawler.arun(url=url) # headless browser: re-resolves DNS, follows redirects
Path:
src/praisonai-agents/praisonaiagents/tools/crawl4ai_tools.py
Function:
Crawl4AITools.crawl / crawl4ai
Snippet:
result = await crawler.arun(url=url, config=config) # no _is_safe_crawl_url / no per-connect validation
Issue: the only SSRF check is the single pre-fetch _is_safe_crawl_url() on the initial URL string in web_crawl() (see PRAI-05). The headless browser then resolves and connects independently and follows redirects in-browser — no resolved-IP pinning, no per-hop/per-connect validation. Input (urls) is attacker/agent-controlled; the sink is crawler.arun(url=...); the guard is bypassed by DNS rebinding (TOCTOU) and by redirects (followed in-browser).
Attack flow / Why bypassed / Security boundary
Identical to PRAI-05: TOCTOU between the guard's resolution and the browser's connection; redirects followed in-browser; internal response returned as crawl content. See PRAI-05.
Proof of Concept
Environment
crawl4ai + Playwright Chromium installed in a dedicated runtime container (127.0.0.1:18081), same controlled internal canary + rebinding DNS. Runnable assets: PraisonAI-Runtime-Repro\runtime-files\ (docker-compose.crawl.yml).
Steps to reproduce
SSRF-04-01-Crawl4AI-DNS-Rebind-Trigger→127.0.0.1:18081:
POST /tool/web_crawl HTTP/1.1
Host: 127.0.0.1:18081
Content-Type: application/json
{"url":"http://rebind.lab:8081/secret"}
- Redirect variant
SSRF-04-03-Crawl4AI-Redirect-Readback:{"url":"http://redirector:8082/redirect-to-internal"}.
Expected result
The crawl backend refuses internal destinations regardless of DNS timing/redirects.
Actual result
HTTP 200, "provider":"crawl4ai", response content contains PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91 + FAKE_INTERNAL_TOKEN_DO_NOT_USE_7f3a91 for both the DNS-rebinding and the redirect payload.
Screenshots
Crawl4AI DNS rebinding read-back
The attacker-controlled rebind.lab URL is accepted by the Crawl4AI-backed web_crawl endpoint. PraisonAI returns the internal canary response body containing PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91.
<img width="1542" height="763" alt="01-Crawl4AI-Burp-Readback" src="https://github.com/user-attachments/assets/a03b3a1c-e382-4f67-8ea6-b766dceb4a69" />
Crawl4AI DNS rebinding runtime evidence
The runtime log shows the Crawl4AI/Chromium backend resolving rebind.lab to an internal Docker IP during the fetch phase. The internal canary receives GET /secret from a headless Chrome user agent.
<img width="1659" height="946" alt="02-Crawl4AI-DNS-Log-And-Internal-Hit" src="https://github.com/user-attachments/assets/d93db090-3e39-43d0-af3b-5d1d8f614db8" />
Crawl4AI redirect read-back
The attacker-controlled redirector URL is accepted by the Crawl4AI-backed endpoint. PraisonAI follows the…
- Record
PYSEC-2026-4269- CVSS 3.1
- 8.5 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
praisonaiagentsPyPI |
through 1.6.77 | 1.6.78 |
praisonaiagentsPyPI |
before 1.6.78, plus listed versions 0.0.10.0.100.0.1000.0.1010.0.102 Show 45 moreShow less0.0.1030.0.1040.0.1050.0.1060.0.1070.0.1080.0.1090.0.110.0.1100.0.1110.0.1120.0.1130.0.1140.0.1150.0.1160.0.1170.0.1180.0.1190.0.120.0.1200.0.1210.0.1220.0.1230.0.1240.0.1250.0.1260.0.1270.0.1280.0.1290.0.130.0.1300.0.1310.0.1320.0.1330.0.1340.0.1350.0.1360.0.1370.0.1380.0.1390.0.140.0.1400.0.1410.0.1420.0.143 |
1.6.78 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-61429 is a high vulnerability (CVSS 8.4) in Mervinpraison Praisonai, published July 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in praisonaiagents 1.6.78.
References
github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g59-gm2v-qhvq
vulncheck.com/advisories/praisonai-before-ssrf-via-crawl4ai-chromium-backend
nvd.nist.gov/vuln/detail/CVE-2026-61429
pypi.org/project/praisonaiagents
Left out here: 554 versions and the rest of 3 source descriptions. The JSON record has them.