VulnSocial

CVE-2026-40114Disclosure(praison / praisonai)

LOWCVSS 10.0 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhook_url in the request body with no URL validation. When a submitted job completes (success or failure), the server makes an HTTP POST request to this URL using httpx.AsyncClient. An unauthenticated attacker can use this to make the server send POST requests to arbitrary internal or external destinations, enabling SSRF against cloud metadata services, internal APIs, and other network-adjacent services. This vulnerability is fixed in 4.5.128.

praison CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • praisonai

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
praison
Products
praisonai

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-04-10: 3Technical Details · 2026-04-10: 304-10
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-40114 PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhook_url in the request body with no URL validation. When… https://www.cve.org/CVERecord?id=CVE-2026-40114

    Post summary

    CVE-2026-40114 highlights a flaw in PraisonAI's API that accepts arbitrary webhook URLs without validation. The post provides a basic vulnerability description but lacks a PoC, exploit code, patch, or evidence of active exploitation.

    00010150
    57.0K followersView on X
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-40114 PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbitrary webhook_url in the request body with no URL validation. When… https://www.cve.org/CVERecord?id=CVE-2026-40114 ----- Traducción: CVE-2026-40114 Pra… http://infoflow.cloud`

    Post summary

    The tweet references CVE-2026-40114, noting that a specific API endpoint in PraisonAI accepts arbitrary webhook URLs without validation, but provides no exploit, patch, or evidence of active exploitation.

    0000027
    67 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-40114 Server-Side Request Forgery via Unvalidated Webhook URL in PraisonAI Before 4.5.128 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40114

    Post summary

    The text announces a new SSRF vulnerability (CVE-2026-40114) in PraisonAI versions before 4.5.128, detailing the flaw but providing no PoC, exploit code, mitigation, or evidence of active exploitation.

    0000041
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apppraisonpraisonai---

Explore more

Back to dashboardpraison CVEspraisonai vulnerabilities