CVE-2026-55535: PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

August 25, 2026

The webhook_url field in the Jobs API silently passes validation when DNS resolution fails (socket.gaierror), enabling DNS rebinding attacks. An attacker’s domain can initially resolve to a public IP (passing validation) then switch to an internal IP before the server makes the HTTP request.

References

github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hmfx-4v44-9qw9
github.com/advisories/GHSA-hmfx-4v44-9qw9
nvd.nist.gov/vuln/detail/CVE-2026-55535

Code Behaviors & Features

Detect and mitigate CVE-2026-55535 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →