CVE-2026-56836 in PraisonAI
Summary
by MITRE • 10/23/2026
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within PraisonAI versions ranging from 4.5.112 to just before 4.6.59 represents a critical misconfiguration of the application's command-line interface and web server initialization logic, leading to an unauthenticated remote code execution risk through administrative endpoints. PraisonAI operates as a multi-agent team system where various commands are managed via a Typer-based console entrypoint. In the affected versions, the recipe command was registered within this Typer application structure, specifically delegating the serve function to a legacy implementation located in src/praisonai/praisonai/cli/commands/recipe.py. While the developers included a deprecation warning indicating that this specific code path is outdated and slated for removal, they failed to adequately secure or disable the underlying functionality during its transitional period. This oversight allows users invoking the recipe serve command to inadvertently expose internal services to external networks without any protective barriers.
The core technical flaw lies in how the application initializes its HTTP server when invoked through this deprecated Typer command. When a user executes the command, the system attempts to start the Recipe HTTP server but binds it to all available network interfaces rather than restricting access strictly to localhost or 127.0.0.1. More critically, the initialization process fails to load necessary authentication middleware because the configuration object lacks an auth section. In modern versions of PraisonAI, the create_app function is designed to attach API-key validation and JSON Web Token (JWT) verification mechanisms if such configurations are present. However, in this specific legacy code path, the absence of these configuration parameters results in a web application stack that operates with no authentication requirements whatsoever. This means any network request reaching the server can interact directly with exposed endpoints without providing credentials or tokens.
The operational impact of this vulnerability is severe due to the exposure of administrative functions over an unauthenticated interface. Specifically, the endpoint /admin/reload becomes accessible to any actor on the network that can reach the host machine's IP address where the service is bound. This endpoint typically triggers a reload mechanism for the AI agent configurations or recipes running within the system. An attacker exploiting this flaw could potentially force the application to reload its configuration files, which may lead to denial of service if invalid configurations are injected, or more dangerously, facilitate remote code execution if the reloading process involves parsing and executing untrusted input data embedded in those configuration files. This aligns with CWE-287 Improper Authentication, as the system fails to verify identity before granting access to sensitive administrative functions, and CWE-613 Insufficient Session Expiration or Privilege Assignment depending on how the reload affects session states. Furthermore, from an ATT&CK perspective, this vulnerability facilitates Initial Access through exposed services with weak authentication controls and could be leveraged for Execution if the reload mechanism allows arbitrary code injection via configuration manipulation.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to upgrade PraisonAI to version 4.6.59 or later, where this vulnerability has been patched by removing or securing the deprecated Typer command path. For environments that cannot immediately upgrade, administrators should ensure that the service binds exclusively to localhost interfaces using explicit configuration flags if available in earlier versions, thereby preventing external network access. Additionally, implementing a reverse proxy such as Nginx or Apache with strict IP whitelisting and authentication requirements can provide an additional layer of defense for legacy deployments. It is also crucial to audit all running instances of PraisonAI to ensure that no deprecated commands are being invoked in production environments, as these paths lack the security hardening present in newer releases. Regular vulnerability scanning should include checks for unauthenticated administrative endpoints on any exposed services associated with AI agent frameworks.