CVE-2026-61429 is a server-side request forgery vulnerability affecting MervinPraison's PraisonAI product prior to version 1.6.78. The issue resides in the Crawl4AI/Chromium backend where SSRF validation can be bypassed through DNS rebinding and HTTP redirect techniques. Attackers can craft URLs that initially pass validation but resolve to internal network services after redirects, allowing the headless browser to access and read internal responses, including sensitive canary values. The vulnerability is rated with a CVSS 4.0 score of 8.4 (high severity). There is no vendor advisory or patch information available at this time, and the product is not a cloud service.

Successful exploitation enables attackers with limited privileges to bypass SSRF protections and access internal services and sensitive information within the network, such as canary values. This could lead to further internal reconnaissance or exploitation. There are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to internal services from the PraisonAI environment and monitor for suspicious SSRF activity. Avoid exposing the vulnerable versions in untrusted environments.