CVE-2026-57114
Jobs webhook SSRF protection bypass via DNS rebinding
Summary
PraisonAI's Async Jobs API validates webhook_url when a job request is parsed
and again when the internal Job object is constructed. That validation blocks
direct loopback/private targets, but it is not bound to the later network
request. When a job completes, _send_webhook() passes the original hostname to
httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded
transport.
An attacker-controlled hostname can therefore resolve to a public IP during
Pydantic validation and later resolve to loopback/private/cloud-metadata
infrastructure during webhook delivery. This bypasses the intended SSRF guard in
current supported releases.
This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm
("Server-Side Request Forgery via Unvalidated webhook_url in Jobs API"). I defer
to maintainers on whether this should be a new advisory/CVE or an amendment to
the prior advisory, but current supported releases still appear affected.
Affected Component
Package:
praisonai
Files:
src/praisonai/praisonai/jobs/models.py
src/praisonai/praisonai/jobs/executor.py
src/praisonai/praisonai/jobs/router.py
Relevant code paths:
JobSubmitRequest.validate_webhook_url()
Job.validate_webhook_url()
JobExecutor._send_webhook()
POST /api/v1/runs
Affected Versions
Validated affected:
- v4.5.126 (f00763937bf7f4d091e84533692fc0576fca9b99);
- v4.5.128 (b4e3a8a8);
- v4.6.56 (d3c4a2af);
- v4.6.57 (e90d92231853161ad931f3498da57651a9f8b528);
- current main (2f9677abb2ea68eab864ee8b6a828fd0141612e1,
v4.6.57-4-g2f9677ab).
Suggested affected range for maintainer confirmation:
= 4.5.126, <= 4.6.57
No patched version is known to me at submission time.
v4.5.124 and earlier are covered by the older unvalidated-webhook advisory.
This report is scoped to patched-era releases where direct loopback/private
webhook URLs are rejected but DNS rebinding still bypasses the guard.
Root Cause
Current validation i
⚡ Watch CVE-2026-57114
Get an email if CVE-2026-57114 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-57114)