CVE-2026-61429
HIGHPraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend
Title source: cnaDescription
PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-6g59-gm2v-qhvq)
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g59-gm2v-qhvq
Third Party Advisory third-party-advisory
VulnCheck Advisory: PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend
https://www.vulncheck.com/advisories/praisonai-before-ssrf-via-crawl4ai-chromium-backend
Scores
CVSS v3
8.5
EPSS
0.0022
EPSS Percentile
12.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-918
Status
published
Products (2)
MervinPraison/PraisonAI
< 1.6.78
MervinPraison/PraisonAI
1.6.78
Published
Jul 11, 2026
Tracked Since
Jul 11, 2026