PraisonAI prior to version 4.6.78 exposes an unauthenticated SSRF flaw in its Jobs API /api/v1/runs endpoint. The webhook_url field is only validated on receipt but is re‑resolved when the application initiates an outbound request, enabling a blind SSRF that can expose internal services through DNS rebinding. This flaw is a CWE-918 weakness that compromises private network resources and potentially compromises data, although payload visibility is limited.

Affected deployments are those running MervinPraison's PraisonAI versions older than 4.6.78. Version 4.6.78 and later contain the fix and should be considered secure.

The vulnerability carries a CVSS score of 6.9, indicating medium severity, while the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. A likely attack scenario involves an unauthenticated user sending a crafted POST request to /api/v1/runs with a malicious webhook_url, after which the application will resolve the URL and send an HTTP request to the attacker‑controlled host. The outcome is a blind SSRF that can access internal network services, making detection difficult and exposing internal resources.