High severity · published Oct 12, 2026
CVE-2026-57143
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
praisonaiagents · MervinPraison
< 1.6.62 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57143
x_refsource_CONFIRM
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4pcv-mg8v-vrgf
x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33
x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62
More from praisonaiagents
9.9
CVE-2026-39888
PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
9.8
CVE-2026-57118
PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
9.8
CVE-2026-57123
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
9.8
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
9.8
CVE-2026-40288
PraisonAI: Critical RCE via `type: job` workflow YAML