CVE-2026-61429

Name: CVE-2026-61429 — Vulnerability Record
Brand: Quanteta Data Lab
SKU: CVE-2026-61429

HIGH

CVSS v3.1: 8.5

NetworkNo user interactionSSRFVendor advisory ref

Source data as of: 2026-07-12 05:00:25 UTC

At a glance

Severity: HIGH
CVSS: 8.5 v3.1 · NVD
EPSS: EPSS not provided by FIRST.org for this CVE
CISA KEV: No
Type: SSRF · NVD CWE
Attack conditions (CVSS vector): NetworkNo user interaction · Source: NVD Vector
Published: 2026-07-11 · Modified: 2026-07-11
References: Jump to references (2)

CVSS / EPSS / KEV

CVSS v3.1 8.5 / 10 HIGH Source: NVD

CVSS v4.0 8.4 / 10 HIGH Source: NVD

EPSS — EPSS not provided by FIRST.org for this CVE Source: FIRST.org

CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.

Record details

CVE ID: CVE-2026-61429
CVSS (v3.1): 8.5 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Exploitability subscore: 3.1
Impact subscore: 4.7
CISA KEV: No
Weakness (CWE): CWE-918
Affected configurations (CPE): 0
Published: 2026-07-11
Modified: 2026-07-11
Status: Received

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

Vendor advisory https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g59-gm2v-qhvq
Vendor advisory https://www.vulncheck.com/advisories/praisonai-before-ssrf-via-crawl4ai-chromium-backend

← Back to all records