CVE-2026-57132 in PraisonAI
Summary
by MITRE • 09/14/2026
PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.6.62.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The identified vulnerability resides within PraisonAI, a multi-agent orchestration system designed to manage complex workflows involving multiple AI agents. Specifically, the flaw affects versions prior to 4.6.62 and centers on the authentication logic governing API endpoints used for agent invocation. The application provides a configuration option via the PRAISONAI_CALL_AUTH environment variable, which is intended to allow administrators to disable strict token verification in specific deployment scenarios. However, the implementation of this opt-out mechanism contains a critical logical error that inadvertently bypasses security controls entirely rather than just relaxing them as perhaps intended or documented.
When the PRAISONAI_CALL_AUTH setting is explicitly configured to disabled, the verify_token middleware function fails to enforce authentication requirements for requests directed at the /api/v1/agents/{id}/invoke endpoint. This endpoint is critical as it serves as the primary interface for triggering agent execution and accessing associated resources. Instead of rejecting unauthenticated requests or requiring a valid token even in this mode, the system accepts any request without verifying the presence or validity of a CALL_SERVER_TOKEN. This behavior effectively removes the authentication barrier that protects sensitive operational interfaces from unauthorized access.
The operational impact of this vulnerability is severe for deployments relying on the advertised opt-out feature. Because the endpoint becomes accessible to unauthenticated actors, attackers can invoke registered agents remotely. This exposure grants them the ability to execute commands through connected tools and potentially read or manipulate private context data associated with those agents. The scope of damage depends heavily on the permissions granted to the invoked agent but generally includes unauthorized access to proprietary information, potential execution of arbitrary code via tool integrations, and a complete compromise of the confidentiality and integrity of the AI system's operational state.
From a classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as the application fails to properly verify credentials before granting access to sensitive functionality. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, in the context of abusing misconfigured authentication mechanisms to gain unauthorized entry into a system environment. The flaw represents a classic case where security configuration options are implemented with insufficient validation logic, leading to an unintended state of zero protection rather than controlled access.
To mitigate this risk, organizations running PraisonAI must immediately upgrade to version 4.6.62 or later, which contains the corrected authentication logic that properly handles the disabled setting without exposing endpoints to unauthenticated users. For deployments unable to update immediately due to operational constraints, it is imperative to ensure that PRAISONAI_CALL_AUTH remains enabled and strictly configured with valid tokens. Additionally, network-level controls such as firewalls should be reviewed to restrict access to API endpoints only from trusted IP addresses or internal networks, providing a defense-in-depth layer against exploitation of this misconfiguration until the software patch can be applied.