PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback

The SSRF vulnerability in praisonai allows an attacker to craft malicious requests that appear to originate from the server itself. This can lead to unauthorized access to internal services, data exfiltration, and potentially even remote code execution if the targeted internal service is vulnerable. An attacker could, for example, scan internal networks, access cloud metadata services, or interact with internal APIs without proper authentication. The lack of URL scheme validation and domain allowlisting significantly expands the potential attack surface, making it possible to target a wide range of internal resources.

Applications and systems utilizing praisonai versions 4.5.9 and earlier are at risk. This includes deployments where praisonai is integrated into larger AI pipelines or used to interact with internal APIs. Shared hosting environments where multiple applications share the same server instance are particularly vulnerable, as a compromise of one application could potentially lead to the exploitation of this vulnerability in others.

• python / server:

import os
import subprocess

# Check praisonai version
result = subprocess.run(['pip', 'show', 'praisonai'], capture_output=True, text=True)
version = result.stdout.split('Version: ')[1].split('\n')[0]

if version <= '4.5.9':
    print('Vulnerability detected: praisonai version is vulnerable.')
else:
    print('praisonai version is not vulnerable.')

• generic web: - Check for unusual outbound requests in server logs targeting internal IP addresses or sensitive endpoints. - Monitor for requests to cloud metadata services (e.g., http://169.254.169.254/) originating from the praisonai application.

1. 2026-04-01Disclosure

   disclosure

1. Reservado2026-03-31
2. Publicada2026-04-01
3. Modificada2026-04-06
4. EPSS atualizado2026-04-11

The primary mitigation for CVE-2026-34936 is to upgrade to praisonai version 4.5.90 or later, which includes the necessary fixes. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or reverse proxy to filter outbound requests and block those targeting internal IP addresses or sensitive endpoints. Additionally, carefully review and restrict the permissions granted to the praisonai application to minimize the potential impact of a successful exploit. Monitor network traffic for unusual outbound requests originating from the praisonai application.