CVE-2026-57126

PraisonAI's praisonaiagents library (before version 1.6.58) contains a server-side request forgery (SSRF) bypass in SpiderTools: the _host_is_blocked check inspects only literal host encodings and never resolves DNS names before the agent fetches a URL. An attacker with the ability to supply a URL or link to the agent (via scrape_page, crawl, extract_links, extract_text, or URL-mention fetches) can register a hostname that resolves to a loopback, private, link-local, or cloud-metadata address, bypassing the SSRF policy without needing a DNS-rebinding race. The internal response is then returned to the agent, potentially leaking cloud instance metadata credentials or internal service data (CVSS 8.5, high confidentiality impact). Anyone running praisonaiagents prior to 1.6.58, especially agents that ingest untrusted web content or user-supplied URLs, is affected. The issue is fixed in 1.6.58, and no public proof of concept or exploitation in the wild is known.

What to do: Upgrade praisonaiagents to version 1.6.58 or later immediately (e.g., pip install --upgrade praisonaiagents), and rebuild any deployments or containers that pin older versions. As interim mitigations, block agent egress to RFC1918 ranges, loopback, link-local, and the cloud-metadata endpoint (169.254.169.254) at the network layer, and restrict which users or content sources can submit URLs to the agent. Review logs for past fetches of suspicious attacker-influenced hostnames that resolved to internal addresses, since responses may already have been exposed to the agent's context.