CVE-2026-57125 in PraisonAI
Summary
by MITRE • 09/14/2026
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The identified vulnerability resides within the PraisonAI multi-agent orchestration framework, specifically affecting versions prior to 4.6.59 for the main application and 1.6.59 for the agents library. This security flaw is classified as a critical remote code execution risk stemming from improper input validation and flawed authorization logic in the API endpoint responsible for initiating job runs. The core issue lies in how the system processes YAML configurations submitted by users to define agent behavior, particularly regarding command execution permissions.
The technical root cause involves an authentication bypass combined with insecure direct object references or broken access control mechanisms within the POST /api/v1/runs Jobs API. This endpoint is designed to accept unauthenticated requests, which itself may be a configuration issue depending on deployment context, but becomes critically dangerous due to how it handles the agent_yaml parameter. Attackers can supply maliciously crafted YAML structures that define specific agents and their allowed actions. Crucially, the vulnerability exploits a logic error in the approval workflow where setting the approve field allows an execute_command action to be marked as pre-approved by YAML configuration before the @require_approval decorator or middleware has a chance to enforce critical security checks on sensitive tools.
This sequence of events effectively creates a chain that bypasses intended safety guards. Normally, PraisonAI is designed to require explicit operator approval for high-risk actions such as executing operating system commands. However, because the YAML configuration can pre-approve these commands before the approval check runs, an attacker can trick the configured language model agent into invoking arbitrary shell commands without any user interaction or credential verification. The language model, acting under the instructions defined in the unvalidated YAML payload, executes the command with whatever privileges the underlying service account possesses.
The operational impact of this vulnerability is severe, constituting a full remote code execution scenario. An attacker can achieve complete compromise of the host system running the PraisonAI instance by executing arbitrary commands such as downloading and running malware, exfiltrating sensitive data, pivoting to other systems on the network, or establishing persistent backdoors. Since the command execution occurs without operator interaction, there is no opportunity for human intervention to stop malicious activities once they are initiated through this API vector. This aligns with CWE-94 Improper Control of Generation of Code and CWE-287 Improper Authentication in terms of input handling and access control failures.
From a threat intelligence perspective, this vulnerability maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically allowing for remote code execution via API endpoints that lack proper authentication or authorization checks. It also relates to T1190 Exploit Public-Facing Application where the attacker leverages exposed services to gain initial access and execute commands within the environment. The ability to bypass approval workflows highlights a failure in defense-in-depth strategies, as multiple layers of security controls were circumvented by exploiting their execution order rather than breaking them individually.
Mitigation requires immediate upgrading to PraisonAI version 4.6.59 or later for the core application and praisonaiagents version 1.6.59 or later for the agents library. These fixed versions address the logic error in the approval workflow, ensuring that critical tools are properly checked before any command execution is permitted regardless of YAML configuration settings. Additionally, organizations should audit their API gateway configurations to ensure that sensitive endpoints like /api/v1/runs require authentication and authorization checks at the network or reverse proxy level as a compensating control. Implementing strict input validation on all user-supplied YAML structures and enforcing least-privilege principles for service accounts running PraisonAI will further reduce the blast radius in case of future vulnerabilities. Regular security assessments focused on AI agent orchestration frameworks are recommended to identify similar logic flaws in approval workflows and command execution handlers.