SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-61429

HIGH · CVSS 8.5 EPSS 0.22% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-11 · Last synced 2026-08-10

CyberRota Analysis

AI-Generated

PraisonAI versions prior to 1.6.78 are vulnerable to a server-side request forgery (SSRF) flaw that allows attackers to bypass validation mechanisms through DNS rebinding and HTTP redirects. This exploitation can lead to unauthorized access to internal services, potentially exposing sensitive information such as canary values. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of internal data breaches.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit
GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-61429
Severity
HIGH
CVSS
8.5
EPSS
0.22%

Original NVD Description

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.