PraisonAI, a multi-agent teams system by MervinPraison, had an SSRF vulnerability (CVE-2026-34936) in versions before 4.5.90. The vulnerability occurs because the functions passthrough() and apassthrough() accept an api_base parameter controlled by the caller, which is concatenated with an endpoint and passed to httpx.Client.request() without any URL scheme validation, private IP filtering, or domain allowlisting. This allows attackers with low privileges to cause the server to make HTTP requests to arbitrary internal or external hosts. The vulnerability is triggered when the litellm primary path raises an AttributeError. The vendor fixed this issue in version 4.5.90. The CVSS score of 7.7 reflects a high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and a high confidentiality impact.

An attacker with low privileges can exploit this vulnerability to make the vulnerable PraisonAI server send HTTP requests to arbitrary hosts reachable from the server. This can lead to unauthorized information disclosure from internal or protected network resources. There is no direct impact on integrity or availability according to the CVSS vector. No known exploits in the wild have been reported.

This vulnerability has been patched in PraisonAI version 4.5.90. Users should upgrade to version 4.5.90 or later to remediate this issue. Since this is not a cloud service, remediation depends on applying the official patch. Patch status is confirmed by the vendor advisory stating the fix in version 4.5.90.