EUVD-2026-77615
GHSA-j4hj-7hfh-g2f4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (PR:N), but the fail-open only occurs under a non-default operator misconfiguration (auth enabled, secret omitted), so AC:H; full recipe/tool execution yields C:H/I:H/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET and the corresponding recipe value are absent. Unauthenticated clients can then reach recipe execution, input, and output surfaces and may trigger connected tools despite the operator explicitly enabling authentication. This issue is fixed in 4.6.58.
AnalysisAI
Authentication bypass in PraisonAI's recipe serve command: when an operator selects auth: api-key or auth: jwt in a recipe YAML but omits the matching api_key:/jwt_secret: value and does not export PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET, APIKeyAuthMiddleware and JWTAuthMiddleware take a fail-open branch and forward every non-/health request unauthenticated to the recipe execution, input, and output surfaces, potentially triggering connected tools. Remote unauthenticated attackers who can reach an exposed recipe-serve endpoint (CVSS:3.1/AV:N/PR:N/UI:N) can therefore act as if authenticated, though independent analysis raises attack complexity to AC:H because the rawe 9.8 vendor score only manifests under a specific operator mis-deployment - the fail-open does not occur when the secret is set or when authentication was never enabled. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific operator misconfiguration of `praisonai recipe serve`: the operator must (1) select `auth: api-key` or `auth: jwt` in the recipe YAML, AND (2) omit the corresponding `api_key:`/`jwt_secret:` value in that YAML, AND (3) not export PRAISONAI_API_KEY / PRAISONAI_JWT_SECRET in the environment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The raw CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), which on its face reads as a critical remote-unauthenticated compromise, but the description qualifies this heavily: the fail-open only manifests when an operator explicitly selects api-key or JWT auth in the recipe YAML yet fails to supply the corresponding secret both in YAML (api_key:/jwt_secret:) AND in the environment (PRAISONAI_API_KEY/PRAISONAI_JWT_SECRET). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade `praisonai` to 4.6.58 (or the newer 4.6.59 build referenced in the advisory's version data) via `pip install --upgrade praisonai`, per the release at https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58 and advisory GHSA-j4hj-7hfh-g2f4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all PraisonAI recipe serve deployments, check for auth: api-key or auth: jwt configured without matching api_key:/jwt_secret: values or PRAISONAI_API_KEY/PRAISONAI_JWT_SECRET environment variables, and either disable external exposure or set the missing secrets and restart the service. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today