An unvalidated webhook_url field in PraisonAI’s job‑submission API allows an attacker to specify any HTTP or HTTPS target. When a job finishes, the server automatically performs a POST request to that URL using httpx.AsyncClient. The flaw permits the server to reach arbitrary internal or external services, enabling the attacker to access cloud metadata, internal APIs, or other networks. This is a classic server‑side request forgery weakness.

All installations of MervinPraison’s PraisonAI released before version 4.5.128 are impacted. The vulnerability exists in the /api/v1/runs endpoint where a webhook_url can be supplied without validation.

The issue is assigned a high severity rating, and because the endpoint does not require authentication, any remote user can trigger the flaw with a simple crafted request. The ability to direct the server to any destination gives attackers a powerful vector to exfiltrate data or compromise internal services. Overall, the risk from this vulnerability is substantial.