PraisonAI CVE-2026-56836

Exploitation requires that an operator start the Recipe HTTP server via the deprecated Typer path 'praisonai recipe serve' bound to a non-localhost interface (e.g. --host 0.0.0.0) without passing --api-key or a config file that sets auth; the default host is 127.0.0.1, which is not exposed. The /admin/reload endpoint is only reachable when --admin (enable_admin) is set. Presence of PRAISONAI_API_KEY in the environment does NOT protect this path, because the Typer command only sets auth when --api-key is passed explicitly. Limiting factors: the reachable-interface binding is a non-default choice (though the official Docker example uses --host 0.0.0.0); the hardened legacy feature handler and create_auth_middleware() fail closed, so only this specific Typer callsite is affected; and concrete impact depends on the configured recipes (tool-enabled/powerful recipes increase severity). No end-user interaction or authentication is required once the server is exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 8.2, C:L/I:H) describes an easy, remote, unauthenticated flaw, and that is accurate for the attacker - once the Recipe HTTP server is reachable, no credentials are needed. However, the signals must be read together with the deployment precondition: the server defaults to host 127.0.0.1, and the vulnerability is only exposed when an operator runs 'praisonai recipe serve --host 0.0.0.0' (or otherwise binds to a non-localhost interface) via the deprecated Typer path without --api-key. So the PR:N/AV:N metrics are correct for the attacker but gated by a non-default operator action, which lowers real-world exposure relative to the raw score. No KEV listing is present, so this is NOT confirmed actively exploited. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. A local-only proof-of-vulnerability exists in the GHSA advisory, but it is in-process (monkey-patched launcher + Starlette test client) and is not verified as working remote exploit code. The vendor/triage Decision label is 'this_week' (not act_now or emergency), consistent with a serious but config-dependent authentication-bypass issue rather than a mass-exploited emergency. Net: a genuine high-severity auth bypass worth patching promptly, but realistic risk is concentrated in deployments that bind the recipe server to a reachable interface (notably the Docker example in the docs, which uses --host 0.0.0.0).

An operator deploys PraisonAI using the documented Docker pattern 'praisonai recipe serve --host 0.0.0.0 --port 8765' (or adds --admin), which routes through the deprecated Typer command and never sets config.auth, so create_app() attaches no API-key/JWT middleware. Any network caller that can reach the port sends unauthenticated requests to the recipe API (GET /v1/recipes, POST /v1/recipes/run, /stream, /validate) and, if --admin was used, POST /admin/reload. A public, local-only PoV exists in the advisory demonstrating the bypass (admin/reload and openapi return 200 with no auth); it is not verified as a working remote exploit.