CVE-2026-61430 describes an SSRF vulnerability in MervinPraison's PraisonAI product prior to version 1.6.78. The issue exists in the web_crawl tool, which validates hostnames at the time of checking but re-resolves them at connection time without enforcing IP pinning. This flaw enables attackers to exploit DNS rebinding techniques to circumvent SSRF protections and retrieve HTTP response data from internal or loopback network services. The vulnerability is rated high severity with a CVSS 4.0 score of 8.4. No official patch or remediation guidance is currently available.

An attacker with low privileges can exploit this SSRF vulnerability to bypass hostname validation and access internal HTTP services that are normally inaccessible. This can lead to unauthorized disclosure of internal HTTP response bodies from private or loopback network services. The vulnerability does not require user interaction and has a high impact on confidentiality and security controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting DNS rebinding attacks through network-level controls or DNS filtering as a temporary mitigation. Avoid exposing the vulnerable web_crawl tool to untrusted users.