CVE-2026-34936

Affected versions of the praisonai package are vulnerable to Server-Side Request Forgery (SSRF) due to the passthrough() and apassthrough() functions accepting a caller-controlled api_base parameter that is concatenated with an endpoint and passed directly to httpx.Client.request() without URL scheme validation, private IP filtering, or domain allowlisting. When the primary litellm code path raises an AttributeError, the fallback branch in passthrough.py constructs a URL from the unvalidated api_base value and issues an HTTP request to the attacker-specified destination. An attacker can supply a crafted api_base pointing to internal network resources, enabling access to cloud instance metadata services such as the EC2 IMDSv1 endpoint to retrieve IAM credentials, or to reach other internal services within the VPC, particularly as the Flask API server deploys with authentication disabled by default.