PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

The SSRF vulnerability in praisonai allows an attacker to craft malicious requests that appear to originate from the server itself. This can lead to unauthorized access to internal services, data exfiltration, and potentially even remote code execution if the targeted internal service is vulnerable. An attacker could, for example, scan internal networks for open ports, access sensitive configuration files, or interact with internal APIs without proper authentication. The blast radius extends to any service reachable from the praisonai server, potentially impacting critical infrastructure and sensitive data.

Applications and systems utilizing praisonai versions 4.5.9 and earlier are at risk. This includes deployments where praisonai is integrated into larger AI pipelines or used to interact with internal APIs. Shared hosting environments where multiple applications share the same server instance are particularly vulnerable, as a compromise of one application could potentially lead to the exploitation of this vulnerability in others.

• python / server:

import os
import subprocess

# Check praisonai version
result = subprocess.run(['pip', 'show', 'praisonai'], capture_output=True, text=True)
version = result.stdout.split('Version: ')[1].split('\n')[0]

if version <= '4.5.9':
    print('Vulnerability detected: praisonai version is vulnerable.')
else:
    print('praisonai version is not vulnerable.')

• generic web: - Check for unusual outbound requests in server logs targeting internal IP addresses or sensitive endpoints. - Monitor for requests to cloud metadata services (e.g., http://169.254.169.254/) originating from the praisonai application.

1. 2026-04-01Disclosure

   disclosure

1. Reserviert2026-03-31
2. Veröffentlicht2026-04-01
3. Geändert2026-04-06
4. EPSS aktualisiert2026-04-11

The primary mitigation for CVE-2026-34936 is to upgrade to praisonai version 4.5.90 or later, which includes the necessary URL validation and filtering to prevent SSRF attacks. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block requests containing suspicious URLs or patterns. Additionally, restrict network access to the praisonai server to only allow connections to necessary internal services. Monitor logs for unusual outbound requests originating from the praisonai server. After upgrade, confirm the fix by attempting a request with a clearly malicious URL (e.g., http://127.0.0.1:8080) and verifying that it is blocked.