PYSEC-2026-3519 — PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

Affected: PyPI: praisonai

# Jobs webhook SSRF protection bypass via DNS rebinding

## Summary

PraisonAI's Async Jobs API validates `webhook_url` when a job request is parsed and again when the internal `Job` object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, `_send_webhook()` passes the original hostname to `httpx.AsyncClient.post()` with no send-time validation, IP pinning, or guarded transport.

An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases.

This appears to be an incomplete fix / patch bypass for `GHSA-8frj-8q3m-xhgm` ("Server-Side Request Forgery via Unvalidated webhook_url in Jobs API"). I defer to maintainers on whether this should be a new advisory/CVE or an amendment to the prior advisory, but current supported releases still appear affected.

## Affected Component

Package:

```text praisonai ```

Files:

```text src/praisonai/praisonai/jobs/models.py src/praisonai/praisonai/jobs/executor.py src/praisonai/praisonai/jobs/router.py ```

Relevant code paths:

```text JobSubmitRequest.validate_webhook_url() Job.validate_webhook_url() JobExecutor._send_webhook() POST /api/v1/runs ```

## Affected Versions

Validated affected:

- `v4.5.126` (`f00763937bf7f4d091e84533692fc0576fca9b99`); - `v4…

Most recent entries from all

PYSEC-2026-3519 — PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding