HIGH 7.2 GitHub
CVE-2026-60091
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
## Summary
PraisonAI's Async Jobs API enables its API-key middleware **only when `PRAISONAI_JOBS_API_KEY` is set**, so by default every endpoint is unauthenticated. An unauthenticated `POST /api/v1/runs` accepts an attacker-controlled `webhook_url`; on job completion the server POSTs the job payload to it via `httpx`. The `webhook_url` has an SSRF validator (`gethostbyname` + private-IP check), but it validates at request time while `httpx` re-resolves at connection time — a DNS-rebinding TOCTO
Affected Products
- pip/praisonai <= 4.6.77
References
- https://github.com/advisories/GHSA-4w49-gwv8-fpjg
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4w49-gwv8-fpjg
- https://nvd.nist.gov/vuln/detail/CVE-2026-60091
- https://nvd.nist.gov/vuln/detail/CVE-2026-62175
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-10-08 via GitHub. Affected: pip/praisonai <= 4.6.77.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.