The vulnerability allows an attacker to bypass PraisonAI's Async Jobs API webhook validation, enabling a DNS rebinding attack that resolves an attacker-controlled hostname to a public IP during job request parsing and to a loopback or cloud‑metadata IP at the time the webhook is delivered. This bypasses the intended Server Side Request Forgery guard and permits the attacker to make internal network requests on behalf of the application, exposing sensitive internal resources or cloud metadata endpoints. The weakness is rooted in improper isolation between validation and send‑time checks, as reflected by CWE‑367 and CWE‑918. It can lead to confidentiality and integrity compromises of internal systems and data.

MervinPraison’s PraisonAI product, versions 4.5.126 through 4.6.58 inclusive, is affected. Versions 4.6.59 and later include the fix that enforces proper send‑time validation and IP pinning for webhook URLs.

PraisonAI assigns a CVSS score of 7.2, indicating high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified from public data. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit this by creating or submitting jobs that contain malicious webhook URLs. The lack of send‑time validation and IP pinning creates a clear attack vector. Once exploited, the attacker can target internal services such as metadata endpoints, potentially obtaining sensitive configuration or credential information.