Which versions of PraisonAI are affected by CVE-2026-61435?

PraisonAI versions before 4.6.78 contain a critical authentication bypass (CVE-2026-61435) allowing remote attackers to invoke registered AI agents when call authentication is disabled, bypassing…. A patch is available.

How to fix or mitigate CVE-2026-61435?

Within 24 hours, inventory all PraisonAI instances running versions prior to 4.6.78 and determine which deployments have PRAISONAI_CALL_AUTH=disabled; immediately apply network segmentation to restrict Call API endpoint access from untrusted networks as interim protection. Within 7 days, deploy PraisonAI version 4.6.78 or later to all affected systems; document any instances where patching is delayed and implement compensating network controls. Within 30 days, complete full patch deployment across development, staging, and production environments, then conduct log forensics on agent invocation records from the past 90 days to identify unauthorized agent executions or enumeration attempts.

PraisonAI CVE-2026-61435

Q: What is the CVSS score of CVE-2026-61435?

CVE-2026-61435 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-44641 HIGH

Improper Authentication (CWE-287)

2026-07-15 VulnCheck

GHSA-gp65-m7q3-4vjw

Authentication Bypass Praisonai Mervinpraison

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Trivial network Host-header spoof needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); invoking agents yields high integrity impact and agent listing gives limited confidentiality (I:H/C:L), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 12:24 vuln.today

Analysis Generated

Jul 15, 2026 - 12:24 vuln.today

CVE Published

Jul 15, 2026 - 11:25 cve.org

HIGH 8.8

DescriptionCVE.org

PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agent_invoke.py) when PRAISONAI_CALL_AUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host from request.url.hostname, which is taken from the client-controlled HTTP Host header. A remote, unauthenticated attacker who can reach the service over the network can send a spoofed 'Host: 127.0.0.1' header to bypass the localhost-only restriction and list (GET /api/v1/agents) and invoke (POST /api/v1/agents/{agent_id}/invoke) registered agents without authentication.

AnalysisAI

Authentication bypass in PraisonAI before 4.6.78 lets a remote, unauthenticated attacker reach the Call API agent-invocation endpoints when the deployment runs with PRAISONAI_CALL_AUTH=disabled. Because the localhost-only safeguard derives the bind host from the client-supplied HTTP Host header, an attacker on the network can send a spoofed 'Host: 127.0.0.1' header to defeat the restriction and both enumerate and invoke registered agents. Vendor patch is available (reported by VulnCheck); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PraisonAI is an open-source multi-agent AI orchestration framework (CPE cpe:2.3:a:mervinpraison:praisonai) that exposes a REST 'Call API' for listing and invoking agents in src/praisonai/praisonai/api/agent_invoke.py. The flaw is a classic CWE-287 (Improper Authentication) trust-boundary error: when operators opt out of auth via PRAISONAI_CALL_AUTH=disabled, the code attempts to confine that opt-out to localhost, but it determines the bind/host identity from request.url.hostname, which resolves to the untrusted, client-controlled HTTP Host header rather than the actual socket/network binding. Trusting the Host header for a security decision means any client can assert an arbitrary hostname, so the 'localhost only' gate is enforced against attacker-supplied data instead of the real connection origin.

RemediationAI

Vendor-released patch: upgrade PraisonAI to version 4.6.78 or later, referencing GHSA-2gpf-2492-q9jh (https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2gpf-2492-q9jh) and the VulnCheck advisory (https://www.vulncheck.com/advisories/praisonai-before-authentication-bypass-via-host-header-spoofing). If you cannot patch immediately, stop relying on PRAISONAI_CALL_AUTH=disabled and re-enable Call API authentication so the vulnerable localhost shortcut is never taken; the trade-off is that legitimate local callers must now present credentials. As a network compensating control, do not expose the Call API on any interface reachable beyond loopback - bind the service to 127.0.0.1 at the socket/reverse-proxy layer and use firewall rules to block external access to the agent-invoke endpoints (GET /api/v1/agents and POST /api/v1/agents/{agent_id}/invoke); if a reverse proxy fronts the service, strip or normalize inbound Host headers and reject requests whose Host does not match an allowlisted server name, accepting that overly strict Host filtering can break legitimate virtual-host or health-check traffic.