PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
Date: 2026-06
Affected: pip/praisonai
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CWE: CWE-367
CWE-918
CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)

# Jobs webhook SSRF protection bypass via DNS rebinding ## Summary PraisonAI's Async Jobs API validates `webhook_url` when a job request is parsed and again when the internal `Job` object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, `_send_webhook()` passes the original hostname to `httpx.AsyncClient.post()` with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for `GHSA-8frj-8q3m-xhgm` ("Server-Side Request Forgery via Unvalidated webhook_url in Jobs API"). I defer to maintainers on whether this should be a new advisory/CVE or an amendment to the prior advisory, but current supported releases still appear affected. ## Affected Component Package: ```text praisonai ``` Files: ```text src/praisonai/praisonai/jobs/models.py src/praisonai/praisonai/jobs/executor.py src/praisonai/praisonai/jobs/router.py ``` Relevant code paths: ```text JobSubmitRequest.validate_webhook_url() Job.validate_webhook_url() JobExecutor._send_webhook() POST /api/v1/runs ``` ## Affected Versions Validated affected: - `v4.5.126` (`f00763937bf7f4d091e84533692fc0576fca9b99`); - `v4.


Mitigations:

Architectural layers (MAESTRO):