PraisonAI CVE-2026-55533

Exploitation requires three concurrent conditions: (1) The Recipe server is started with --auth api-key or --auth jwt (i.e., the operator intends to enforce authentication), (2) the corresponding secret is absent - neither the --api-key CLI argument nor PRAISONAI_API_KEY environment variable is set for api-key mode, or neither --jwt-secret nor PRAISONAI_JWT_SECRET is set for JWT mode, AND (3) the server is bound to a non-localhost interface (e.g., --host 0.0.0.0), making it reachable from the network. Deployments where the secret IS correctly supplied are not affected. The CVSS PR:N reflects that the attacker requires no credentials; however, the vulnerable state itself is operator-introduced via misconfiguration, not the default out-of-box state. Local-only deployments (127.0.0.1 binding) are not remotely exploitable even when misconfigured.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N scores 8.2, reflecting network-reachable, zero-complexity, unauthenticated exploitation with high integrity impact - consistent with the ability to trigger arbitrary multi-agent recipe execution. However, real-world risk is conditional: only deployments where the operator has set an auth mode but omitted the corresponding secret are exploitable; instances that correctly supply PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET are unaffected regardless of version. No CISA KEV listing and no EPSS data were provided in the input, and no public exploit code is documented. Risk is therefore highest in automated or containerized deployments where auth is configured via CLI flags without environment variable secrets - a plausible DevOps misconfiguration. The high I:H score is credible given recipe endpoints control multi-agent task execution. The low C:L component reflects possible incidental data exposure through recipe outputs rather than direct credential theft.

An attacker scans for PraisonAI Recipe servers listening on non-localhost interfaces (e.g., port 8080 exposed via cloud security group misconfiguration). They confirm the server is running with --auth api-key but no PRAISONAI_API_KEY by sending an unauthenticated POST /v1/recipes/run with a crafted recipe payload and observing a 200 response rather than a 401. With unauthenticated execution access, they submit recipes that invoke internal tools or exfiltrate data accessible to the agent runtime. No public POC is documented, but the exploit path is fully described in the vendor's own security advisory.