CVE-2026-44335

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. This issue has been patched in version 1.6.32.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
MervinPraison	PraisonAI	< 1.6.32

References

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q9pw-vmhh-384gExploit, Vendor Advisory
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q9pw-vmhh-384gExploit, Vendor Advisory

Timeline

Published: May 8, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-443369.6PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) regi CVE-2026-443376.3PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-st CVE-2026-443387.3PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authent CVE-2026-443398.6PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents version 1.6.37, praisonaiagents resolves unre CVE-2026-44348.1Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack vi CVE-2026-443407.5PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and reci CVE-2026-443415.3GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access CVE-2026-443425.3New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email CVE-2026-443439.8WGDashboard is a dashboard for WireGuard VPN. Prior to 4.3.2, there are critical vulnerabilities affecting WGDashboard that, if exploited, c CVE-2026-443446.6Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` c CVE-2026-443458.8BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/_int CVE-2026-443468.8BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, a malicious bent