Affected: MervinPraison PraisonAI

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

Affected: PyPI: praisonai

## Summary

PraisonAI's Async Jobs API enables its API-key middleware **only when `PRAISONAI_JOBS_API_KEY` is set**, so by default every endpoint is unauthenticated. An unauthenticated `POST /api/v1/runs` accepts an attacker-controlled `webhook_url`; on job completion the server POSTs the job payload to it via `httpx`. The `webhook_url` has an SSRF validator (`gethostbyname` + private-IP check), but it validates at request time while `httpx` re-resolves at connection time — a DNS-rebinding TOCTOU that reaches internal services. Runtime-confirmed as an **unauthenticated, blind** SSRF (the internal canary received the POST; the internal response is not returned to the attacker). Severity Medium.

## Details

### Affected component - Package: `praisonai` 4.6.63. Files: `src/praisonai/praisonai/jobs/server.py`, `jobs/router.py`, `jobs/executor.py`, `jobs/models.py`.

### Vulnerable code / root cause

Path: `src/praisonai/praisonai/jobs/server.py`

Function: `create_app`

Snippet: ```python jobs_api_key = os.environ.get("PRAISONAI_JOBS_API_KEY") # ... if jobs_api_key: app.add_middleware(JobsAPIKeyMiddleware) # auth ONLY when env var is set ``` Issue: with the env var unset (default), no auth middleware is added → all endpoints unauthenticated. Default bind is `127.0.0.1`.

Path: `src/praisonai/praisonai/jobs/router.py`

Function: `submit_job`

Snippet: ```python @router.post("", response_model=JobSubmitResponse, status_code=202) async def submit_job(request, response, body:…