CVE-2026-57134 in PraisonAI
Summary
by MITRE • 09/15/2026
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within PraisonAI versions ranging from 1.5.1 through 1.7.2 represents a critical authentication bypass flaw rooted in inconsistent implementation of security policy evaluations. As a multi-agent team system, PraisonAI relies on robust access controls to ensure that only authorized entities can interact with its Model Context Protocol tools and resources. The core technical defect resides within the MCPSecurity.evaluatePolicy function located in the source file src/praisonai-ts/src/mcp/security.ts. This function is responsible for validating incoming requests against configured security policies before granting access. However, the logic governing credential validation exhibits a significant conditional gap that undermines the integrity of authentication mechanisms for specific authorization methods.
Specifically, when an HTTP request arrives with an Authorization header specifying either api-key or bearer as the AuthMethod, the system correctly invokes the configured credential validator to verify the authenticity and validity of the provided credentials. In contrast, requests utilizing Basic authentication or OAuth flows bypass this critical verification step entirely if they present any non-empty Authorization header value. The code logic erroneously assumes that the mere presence of an authorization string is sufficient for these methods, failing to call auth.validate() as it does for other types. Consequently, the system returns a positive authenticated result regardless of whether the credentials are valid, expired, or completely fabricated. This design flaw effectively neutralizes the security controls intended by Basic and OAuth policies, allowing any actor with network access to authenticate successfully without possessing legitimate credentials.
The operational impact of this vulnerability is severe, as it permits unauthorized actors to execute MCP tools and access sensitive resources protected by these specific authentication schemes. An attacker can exploit this bypass to perform actions on behalf of authenticated users or system administrators, potentially leading to data exfiltration, manipulation of agent behaviors, or further compromise of the underlying infrastructure hosting PraisonAI. Since multi-agent systems often have elevated privileges to interact with external APIs and internal services, an unauthorized actor leveraging this flaw could trigger cascading failures or malicious operations across the entire agent network. The lack of proper credential validation means that traditional security monitoring tools relying on authentication logs may fail to detect these intrusion attempts accurately, as they will appear as successful authentications rather than failed login attempts.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function within the Common Weakness Enumeration framework. From a tactical perspective, it corresponds to ATT&CK technique T1078 Valid Accounts, where adversaries use legitimate credentials or bypass authentication mechanisms to maintain access. To mitigate this issue, organizations must immediately upgrade PraisonAI to version 1.7.2 or later, which contains the corrected logic ensuring that all AuthMethod types undergo rigorous credential validation before granting access. In environments where an immediate patch is not feasible, network-level controls such as Web Application Firewalls should be configured to inspect Authorization headers for known valid token formats and reject malformed requests at the perimeter. Additionally, implementing strict logging of authentication attempts with detailed failure reasons can aid in detecting exploitation attempts while waiting for a full remediation rollout.