Vulnerability Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor._send_webhook() later performs a fresh lookup, allowing DNS changes to direct the request to an internal service. This issue is fixed in version 4.6.58.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828f
- https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rg5q-pp8p-f7
FAQ
What is CVE-2026-55537?
CVE-2026-55537 is a vulnerability with a CVSS score of 7.1 (HIGH). PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses e...
How severe is CVE-2026-55537?
CVE-2026-55537 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55537?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.