CVE-2026-57131 in PraisonAI
Summary
by MITRE • 09/14/2026
PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. This vulnerability is fixed in 4.6.58.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The identified vulnerability resides within the PraisonAI multi-agent orchestration framework, specifically affecting versions prior to 4.6.58. The core issue stems from a critical misconfiguration in the application's routing and authentication middleware. The server endpoint responsible for creating applications mounts the router function create_router under the path /api/v1/runs without enforcing any form of authentication or per-job authorization checks. This architectural flaw effectively exposes sensitive operational endpoints to unauthenticated network clients, bypassing the security controls that should restrict access to authorized users only.
From a technical perspective, this represents a classic case of broken object level authorization combined with missing function level controls. By mounting the router without an associated authentication middleware or permission verification logic, the system fails to validate the identity of the requester before processing requests. Consequently, any entity capable of reaching the network interface hosting the PraisonAI service can interact directly with these endpoints. The lack of per-job authorization means that once a request is accepted, there are no checks to ensure the requesting user has permission to execute specific agents or access particular job resources. This allows for complete lateral movement within the application's functional scope by any authenticated or unauthenticated actor depending on the broader network security posture.
The operational impact of this vulnerability is severe due to the nature of PraisonAI as an agent orchestration system capable of executing complex tasks and interacting with external tools. Attackers can submit arbitrary, attacker-controlled prompts and configure agents in ways that were not intended by administrators. This capability extends beyond mere execution; attackers can list existing jobs, read their contents which may contain sensitive data or configuration details, stream results to exfiltrate information, and critically, cancel or delete other users' jobs. Such actions disrupt service availability and integrity while potentially causing significant operational downtime for legitimate users relying on the multi-agent workflows.
Furthermore, this vulnerability poses a substantial risk of credential exposure and tool abuse. Since agents often require API keys, database credentials, or access tokens to interact with connected tools such as cloud services, databases, or external APIs, unauthorized execution allows attackers to leverage these capabilities. The attacker can use the system's own infrastructure to perform actions on behalf of the service account, potentially leading to data theft, resource exhaustion, or further compromise of downstream systems that trust the PraisonAI agent's permissions. This effectively turns the orchestration platform into a proxy for malicious activities, amplifying the blast radius beyond the immediate application environment.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-862 Missing Authorization in the Common Weakness Enumeration database. In terms of offensive security frameworks, it maps to MITRE ATT&CK techniques related to Initial Access via unauthenticated endpoints and Privilege Escalation through broken access controls. The ability to manipulate job states also relates to Impact categories involving Denial of Service and Data Exfiltration.
To mitigate this vulnerability, organizations must immediately upgrade the PraisonAI installation to version 4.6.58 or later where these authentication and authorization checks have been implemented by the developers. For environments that cannot be updated instantly due to dependency constraints, temporary mitigations should include placing a reverse proxy in front of the application to enforce strict access control lists based on IP addresses if the service is only intended for internal use, although this is not a substitute for proper authentication. Additionally, network segmentation can help limit exposure by ensuring the PraisonAI interface is not directly accessible from untrusted networks until the patch is applied. Regular security audits of API endpoints to ensure consistent application of middleware are recommended to prevent similar misconfigurations in future updates or custom integrations.