PraisonAI CVE-2026-57127

Exploitation requires a specific operator misconfiguration of praisonai recipe serve: the operator must (1) select auth: api-key or auth: jwt in the recipe YAML, AND (2) omit the corresponding api_key:/jwt_secret: value in that YAML, AND (3) not export PRAISONAI_API_KEY / PRAISONAI_JWT_SECRET in the environment. When the secret resolves to None, APIKeyAuthMiddleware/JWTAuthMiddleware take a if not expected_key/secret: return await call_next(request) fail-open branch and forward all requests unauthenticated. Limiting factors: the endpoint must be network-reachable to the attacker, and the vulnerable state does NOT occur in a correctly-configured deployment (secret set) nor when auth was never enabled - so it is a mis-deploy of an auth-enabling operator, not a universal default. Impact is bounded by which recipe execution surfaces and connected tools are exposed.

The raw CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), which on its face reads as a critical remote-unauthenticated compromise, but the description qualifies this heavily: the fail-open only manifests when an operator explicitly selects api-key or JWT auth in the recipe YAML yet fails to supply the corresponding secret both in YAML (api_key:/jwt_secret:) AND in the environment (PRAISONAI_API_KEY/PRAISONAI_JWT_SECRET). That is a specific misconfiguration precondition, so real-world exposure is narrower than PR:N/AC:L implies - I assess AC:H because the vulnerable state requires an operator to enable-but-not-fully-configure auth. Secondary signals are moderate: EPSS is 0.90% (58th percentile), there is NO CISA KEV listing, and SSVC records Exploitation:poc / Automatable:yes / Technical Impact:total - meaning proof-of-concept-level exploitability (the SnailSploit researcher demonstrated it) but no confirmed active in-the-wild exploitation. Net: this is a genuine authentication-bypass-by-fail-open with high technical impact where present, but exploitability is gated by a deployment mistake rather than being a universal default-config RCE, so it is a real priority for operators who enabled auth on recipe serve, not a blanket internet-wide emergency. Note the impact ceiling (C:H/I:H/A:H) depends on which tools the exposed recipe is wired to.

An operator deploys praisonai recipe serve with auth: api-key set in the recipe YAML, believing that line alone locks down the endpoint, but never sets api_key: nor exports PRAISONAI_API_KEY. The APIKeyAuthMiddleware hits its if not expected_key: return await call_next(request) branch and silently forwards every unauthenticated request to the recipe-execution, input, and output routes; a remote attacker who discovers the exposed listener simply sends requests with no credentials and drives recipe execution and any connected tools. Proof-of-concept exploitability is established (SSVC Exploitation:poc; researcher-published GHSA), though no weaponized in-the-wild use is confirmed.