PraisonAI: Three High-Severity SSRF and Code Execution Flaws Disclosed Together
Key findings • Three high-severity vulnerabilities disclosed in PraisonAI on August 5, 2026. • Two SSRF flaws in the web_crawl tool allow connections to internal destinations. • One code …
Key findings
- Three high-severity vulnerabilities disclosed in PraisonAI on August 5, 2026.
- Two SSRF flaws in the web_crawl tool allow connections to internal destinations.
- One code execution vulnerability exists in the workflow 'include' feature.
- All issues are fixed in PraisonAI version 1.6.58.
On August 5, 2026, a batch of three high-severity vulnerabilities was disclosed in PraisonAI, a multi-agent teams system. These vulnerabilities, all addressed in version 1.6.58, could allow attackers to execute arbitrary code or perform server-side request forgery (SSRF).
Two of the vulnerabilities (CVE-2026-55524 and CVE-2026-55523) relate to SSRF flaws within the web_crawl tool. While these versions include checks to prevent connections to loopback and private IP addresses, the SSRF protection can be bypassed. CVE-2026-55524 specifically highlights that the check is performed only on the initially supplied URL, allowing for connections to attacker-chosen internal destinations by resolving the hostname. CVE-2026-55523 further details that the default httpx fallback in the web_crawl function can be exploited for SSRF.
The third vulnerability, CVE-2026-55522, is a code execution flaw within the workflow "include" feature. In affected versions of both praisonai (3.9.26 through 4.6.57) and praisonaiagents (0.12.12 through 1.6.57), the Workflow._execute_include() function implicitly imports and runs a recipe's tools.py file, creating an avenue for code execution.
All three vulnerabilities have been fixed in PraisonAI version 1.6.58. Users are strongly advised to update to this version to mitigate the risks associated with SSRF and arbitrary code execution.
This coordinated disclosure highlights critical security weaknesses in PraisonAI's handling of external requests and code execution within workflows. Prompt patching is essential to protect against potential exploitation.