TI-2026-71237 Aliases CVE-2026-57143

Server-side request forgery in PraisonAI SearxNG search tools

HIGH 71CWE-20Published 2026-10-12 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

PraisonAI praisonaiagents before 1.6.62 passes the searxng_url parameter to an outbound HTTP request without validating its scheme, host, port, or address. The flaw is a server-side request forgery (CWE-918) in the searxng_search and search_web SearxNG providers. An attacker who injects prompts into content the agent reads can direct the default search tool to internal services and cloud metadata endpoints, and the JSON results enter the agent context. User interaction is required.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00275 20th percentileScored 2026-11-07

Fix Fixed praisonaiagents (MervinPraison): 1.6.62praisonaiagents (PyPI): 1.6.61

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MervinPraison	praisonaiagents	before 1.6.62	1.6.62	Patch available	CNA
—	praisonaiagents (PyPI)	before 1.6.61	1.6.61	Patch available	GHSA-4pcv-mg8v-vrgf

praisonaiagents VendorMervinPraison Affected before 1.6.62 Fixed in 1.6.62 Patch available CNA
praisonaiagents (PyPI) Vendor— Affected before 1.6.61 Fixed in 1.6.61 Patch available GHSA-4pcv-mg8v-vrgf

Remediation

Upgrade praisonaiagents to 1.6.62, the fixed version named in the advisory. The PyPI entry instead lists 1.6.61 as fixed, so the sources disagree.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA praisonaiagents (MervinPraison) Fixed in 1.6.62
Fix · GHSA-4pcv-mg8v-vrgf praisonaiagents (PyPI) Fixed in 1.6.61 Advisory →

Timeline

2026-10-12 Threatist record created from CVE-2026-57143
2026-10-13 CISA SSVC decision points changed
2026-10-13 Priority changed: MEDIUM → HIGH

References

Other 4

TI-2026-79619 Missing authentication in PraisonAI AgentOS exposes agent chat CVSS 3.1CRITICAL 9.8
TI-2026-71236 Missing access control in PraisonAI AgentTeam exposes agent endpoints CVSS 3.1CRITICAL 9.8
TI-2026-44052 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent CVSS 4.0CRITICAL 10.0
TI-2026-41123 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) CVSS 3.1CRITICAL 9.8
TI-2026-41122 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery CVSS 3.1CRITICAL 9.8
TI-2026-41118 PraisonAI MCPServer exposes unauthenticated HTTP tools/call CVSS 3.1CRITICAL 9.8

See all 177 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences