EUVD-2026-65523
GHSA-gfq8-hmph-9gjv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
AV:N and PR:N confirmed by network-reachable unauthenticated endpoint; AC:L because exploitation is trivially simple once the misconfigured target is found; I:H for arbitrary recipe execution capability; C:L for incidental data exposure via recipe outputs; A:N as no availability impact is described.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled. This issue is fixed in version 4.6.58.
AnalysisAI
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe execution endpoints despite authentication being nominally enabled. Versions prior to 4.6.58 of the pip package are affected: when the server is started with --auth api-key or --auth jwt but the corresponding PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET environment variable is absent, create_auth_middleware() silently bypasses all authentication checks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) The Recipe server is started with --auth api-key or --auth jwt (i.e., the operator intends to enforce authentication), (2) the corresponding secret is absent - neither the --api-key CLI argument nor PRAISONAI_API_KEY environment variable is set for api-key mode, or neither --jwt-secret nor PRAISONAI_JWT_SECRET is set for JWT mode, AND (3) the server is bound to a non-localhost interface (e.g., --host 0.0.0.0), making it reachable from the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N scores 8.2, reflecting network-reachable, zero-complexity, unauthenticated exploitation with high integrity impact - consistent with the ability to trigger arbitrary multi-agent recipe execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to PraisonAI v4.6.58 or later via `pip install --upgrade praisonai>=4.6.58`; this is the vendor-confirmed fix (https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58, patch commit https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all PraisonAI deployments running versions prior to 4.6.58 configured with --auth api-key or --auth jwt, and verify whether PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET environment variables are actually present. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Path traversal in PraisonAI multi-agent teams system (versions prior to 4.5.128) enables arbitrary file overwrite throug
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today