Medium severity · published Apr 10, 2026
CVE-2026-40160
PraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallback
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost. The response content is returned to the agent and may appear in output visible to the attacker. This fallback is the default crawl path on a fresh PraisonAI installation (no Tavily key, no Crawl4AI installed). This vulnerability is fixed in 1.5.128.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
PraisonAIAgents · MervinPraison
< 1.5.128 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40160
Exploit
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qq9r-63f6-v542
More from PraisonAIAgents
9.9
CVE-2026-39888
PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
9.8
CVE-2026-57118
PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
9.8
CVE-2026-57123
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
9.8
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
9.8
CVE-2026-40288
PraisonAI: Critical RCE via `type: job` workflow YAML