CVE-2026-55539 in PraisonAI
Summary
by MITRE • 08/25/2026
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in PraisonAI versions prior to 4.6.51 represents a critical failure in access control mechanisms within the Jobs API, specifically affecting the create_app function which mounts the /api/v1/runs endpoint without enforcing authentication requirements. This architectural oversight allows any network-reachable client to interact with sensitive job management operations including submitting new jobs, retrieving execution results, canceling active runs, and deleting existing jobs. The severity of this flaw is amplified by the fact that these actions can be performed using operator credentials, effectively granting unauthorized users full administrative control over the AI agent workflow system. This lack of authentication bypasses standard security boundaries, allowing attackers to manipulate the state of multi-agent teams systems without proper authorization checks or identity verification processes.
From a technical perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function as defined by industry standards. The absence of middleware enforcement means that the application fails to validate credentials before processing requests against sensitive endpoints. In the context of MITRE ATT&CK framework, this behavior facilitates Initial Access through unauthorized API interaction and enables Lateral Movement if an attacker uses compromised operator credentials to execute further malicious jobs across connected systems. The ability to delete or cancel jobs also impacts system availability, potentially disrupting legitimate operations and causing denial of service conditions for authorized users relying on the multi-agent workflow execution pipeline.
The operational impact of this vulnerability is substantial as it compromises both confidentiality and integrity of job data while threatening availability of services. Attackers can exfiltrate sensitive information contained within job results or submitted inputs which may include proprietary algorithms, personal data, or intellectual property protected by organizational security policies. Furthermore the ability to cancel or delete jobs allows for disruption of business-critical automated processes leading to operational downtime and potential financial losses depending on the nature of tasks being executed by the multi-agent teams system. The lack of audit trails associated with unauthenticated requests further complicates incident response efforts as malicious activities may go undetected until significant damage has occurred.
Mitigation strategies focus primarily on upgrading to version 4.6.58 where the fix introduces PRAISONAI_JOBS_API_KEY middleware that enforces Authorization headers or X-API-Key validation for all interactions with the /api/v1/runs endpoint. Organizations currently running vulnerable versions should immediately implement network-level access controls such as firewall rules restricting API port exposure to trusted IP ranges until an upgrade can be performed. Additionally implementing rate limiting and request logging provides defense-in-depth measures that help detect abnormal usage patterns indicative of exploitation attempts. Security teams must also review existing operator credentials for signs of compromise given the window of opportunity available to attackers during the period when authentication was not enforced on these critical endpoints.