CVE-2026-55533 in PraisonAI
Summary
by MITRE • 08/25/2026
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled. This issue is fixed in version 4.6.58.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in PraisonAI versions prior to 4.6.58 represents a critical failure in the implementation of access control mechanisms, specifically within the create_auth_middleware function. As a multi-agent teams system designed for complex orchestration tasks, PraisonAI relies heavily on robust authentication protocols to ensure that only authorized entities can execute operations such as running recipes via the API endpoint POST /v1/recipes/run. The core technical flaw lies in how the middleware validates credentials when either an API key or JSON Web Token (JWT) is provided but not properly configured with the expected secrets, namely PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET. Instead of rejecting requests that lack valid authentication tokens due to missing configuration, the system erroneously allows these requests to proceed as if they were authenticated. This behavior effectively bypasses the intended security boundary, creating a scenario where unauthenticated actors can interact with sensitive backend services and trigger agent executions without proper authorization checks.
From an operational perspective, this misconfiguration leads to severe consequences including unauthorized access to internal systems, potential data exfiltration through recipe execution results, and the risk of denial-of-service attacks if malicious users repeatedly invoke resource-intensive recipes. The ability for externally bound Recipe servers to accept unauthenticated POST requests means that any entity with network connectivity to the PraisonAI instance can exploit this flaw without needing valid credentials. This is particularly dangerous in environments where PraisonAI is exposed to public networks or internal subnets lacking additional perimeter defenses, as it allows attackers to leverage the system’s computational resources for unintended purposes such as cryptomining, scraping sensitive data processed by agents, or using the infrastructure as a pivot point for further lateral movement within the network.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function, both of which describe failures in verifying user identity before granting access to protected resources. In terms of attack vectors, it corresponds to MITRE ATT&CK technique T1078 Valid Accounts when exploited via misconfigured credentials or more broadly to unauthorized API consumption patterns often seen in automated exploitation campaigns targeting exposed endpoints. The root cause stems from a logical error in the middleware’s conditional logic where missing secret configurations are treated as permissive states rather than restrictive ones, violating the principle of least privilege and secure default configuration standards recommended by industry frameworks such as OWASP Application Security Verification Standard version 4 which mandates strict validation of authentication inputs even when optional parameters are absent.
To mitigate this vulnerability, organizations must immediately upgrade to PraisonAI version 4.6.58 or later where the issue has been resolved through corrected middleware logic that properly rejects requests lacking valid authentication tokens regardless of configuration state. Additionally, administrators should enforce strong secret management practices by ensuring PRAISONAI_API_KEY and PRAISONAI_JWT_SECRET are always set to complex, randomly generated values before deployment in production environments. Network-level controls such as Web Application Firewalls can provide supplementary protection by inspecting incoming requests for missing or malformed authentication headers and blocking them at the perimeter layer while internal remediation efforts take place. Regular security audits focusing on API endpoint configurations and middleware implementations are essential to prevent similar misconfigurations from reoccurring in future updates or custom deployments of the PraisonAI platform.