EXECUTIVE SUMMARY:
CVE-2026-44335 with a CVSS score of 7.7 is a Server-Side Request Forgery (SSRF) vulnerability in the PraisonAI project, specifically affecting praisonaiagents versions less than or equal to 1.6.31. The vulnerability arises from a logical flaw in the URL checking logic, which can be bypassed by attackers to exploit SSRF attacks. An attacker can exploit this vulnerability by sending a specially crafted URL, which will bypass the existing detection logic and allow the attacker to access internal network resources. This capability enables the attacker to potentially access sensitive data or perform unauthorized actions on internal systems. If exploited, the business impact and consequences can be severe, including unauthorized data access, system compromise, or disruption of business operations. The exploitation of this vulnerability requires an attacker to have access to a valid URL that can be used to bypass the detection logic, and typically involves sending a malicious request to the affected system.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-44335 with a CVSS score of 7.7 is a Server-Side Request Forgery (SSRF) vulnerability in the PraisonAI project, specifically affecting praisonaiagents versions less than or equal to 1.6.31. The vulnerability arises from a logical flaw in the URL checking logic, which can be bypassed by attackers to exploit SSRF attacks. An attacker can exploit this vulnerability by sending a specially crafted URL, which will bypass the existing detection logic and allow the attacker to access internal network resources. This capability enables the attacker to potentially access sensitive data or perform unauthorized actions on internal systems. If exploited, the business impact and consequences can be severe, including unauthorized data access, system compromise, or disruption of business operations. The exploitation of this vulnerability requires an attacker to have access to a valid URL that can be used to bypass the detection logic, and typically involves sending a malicious request to the affected system.[emaillocker id="1283"]
RECOMMENDATION:
We recommend you to update praisonaiagents to version 1.6.32.
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-q9pw-vmhh-384g