VulnSocial

CVE-2026-61429Disclosure

LOWCVSS 8.4 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-07-11: 3Patch / Workaround · 2026-07-11: 1Technical Details · 2026-07-11: 207-11
Signal classification1 categories
Disclosure
3100.0%
Referenced assets4 URLs
Full discourse3 posts
  • MalwareObserver@MalwareObserver
    Disclosure

    🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-61429](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g59-gm2v-qh... https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g59-gm2v-qhvq #CVE #ZeroDay #PatchManagement

    Post summary

    The tweet announces the discovery of CVE-2026-61429 and directs readers to a GitHub advisory that presumably contains patch details, but offers no proof‑of‑concept, exploit code, or evidence of active exploitation.

    0000038
    10 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-61429 PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation … https://www.cve.org/CVERecord?id=CVE-2026-61429 ----- Traducción: CVE-2026-61429 Las… http://infoflow.cloud`

    Post summary

    The tweet highlights CVE‑2026‑61429, noting a server‑side request forgery flaw in PraisonAI’s Crawl4AI/Chromium backend that can bypass SSRF checks, but it offers no Proof of Concept, exploit code, or patch information.

    0000032
    92 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-61429 PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation … https://www.cve.org/CVERecord?id=CVE-2026-61429

    Post summary

    The brief note reports a new server‑side request forgery (SSRF) vulnerability in PraisonAI versions prior to 1.6.78, but it contains no PoC, exploit code, patch information, or evidence of active exploitation.

    00000592
    57.8K followersView on X

Explore more

Back to dashboard