Vulnerabilities CVE-2026-61430

CVE-2026-61430

High

Open

TLP:CLEAR

PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

Details

CVSS Score: 8.4
EPSS Score ⓘ: 0.21%

10.8th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Confidence: 90%
Published: Jul 15, 2026
Last Modified: Jul 15, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.