Critical severity9.8NVD Advisory· Published May 8, 2026· Updated May 8, 2026

CVE-2026-44335

Description

PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. This issue has been patched in version 1.6.32.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
praisonaiagentsPyPI	< 1.6.32	1.6.32

Affected products

Pachno/Praisonaiagentsinferred
Package: https://pypi.org/project/praisonaiagents
Praison/Praisonaiagents
cpe:2.3:a:praison:praisonaiagents:*:*:*:*:*:python:*:*
Range: <1.6.32

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q9pw-vmhh-384gnvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-q9pw-vmhh-384gghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-44335ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000