Disclosure summary
## Summary PraisonAI's Async Jobs API enables its API-key middleware **only when `PRAISONAI_JOBS_API_KEY` is set**, so by default every endpoint is unauthenticated. An unauthenticated `POST /api/v1/runs` accepts an attacker-controlled `webhook_url`; on job completion the server POSTs the job payload to it via `httpx`. The `webhook_url` has an SSRF validator (`gethostbyname` + private-IP check), but it validates at request time while `httpx` re-resolves at connection time — a DNS-rebinding TOCTOU that reaches internal services. Runtime-confirmed as an **unauthenticated, blind** SSRF (the internal canary received the POST; the internal response is not returned to the attacker). Severity Medium. ## Details ### Affected component - Package: `praisonai` 4.6.63. Files: `src/praisonai/praisonai/jobs/server.py`, `jobs/router.py`, `jobs/executor.py`, `jobs/models.py`. ### Vulnerable code / root cause Path: `src/praisonai/praisonai/jobs/server.py` Function: `create_app` Snippet: ```python jobs_api_key = os.environ.get("PRAISONAI_JOBS_API_KEY") # ... if jobs_api_key: app.add_middleware(JobsAPIKeyMiddleware) # auth ONLY when env var is set ``` Issue: with the env var unset (default), no auth m
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-4w49-gwv8-fpjg
Open original source · Updated Oct 08, 2026
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
Source severity: HIGH / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| pip | praisonai | 4.6.78 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-10-08T17:57:57-04:00
MODIFIED 2026-10-08T17:57:57-04:00
INGESTED 2026-10-10T20:25:14-04:00