Product

PraisonAI (Before 4.6.78)

1 brief RSS

Unauthenticated Server-Side Request Forgery in PraisonAI Jobs API (CVE-2026-60091)

PraisonAI versions before 4.6.78 contain an unauthenticated server-side request forgery (SSRF) vulnerability, CVE-2026-60091, in the Jobs API `/api/v1/runs` endpoint via the `webhook_url` parameter, allowing attackers to exploit DNS rebinding to access internal services.

PraisonAI vulnerability ssrf dns-rebinding

2t 1c 57m ago