CVE-2026-55528: PraisonAI Authentication Bypass Vulnerability

CVE-2026-55528 Overview

CVE-2026-55528 is a missing authentication vulnerability [CWE-306] in PraisonAI, a multi-agent teams system developed by MervinPraison. The AgentServer component exposes a ServerConfig.auth_token configuration option, but the AgentServer._create_app method fails to enforce token validation on any route. Remote callers can subscribe to topics, publish messages, and invoke server actions without presenting a valid Authorization: Bearer header or X-Auth-Token header, even when administrators explicitly configure authentication. The flaw affects praisonaiagents versions prior to 1.6.58 and is resolved in that release.

Critical Impact
Unauthenticated network attackers can fully interact with a PraisonAI AgentServer, publishing messages and triggering agent actions despite an auth_token being configured.

Affected Products

PraisonAI praisonaiagents package versions prior to 1.6.58
PraisonAI deployments exposing the AgentServer ASGI application over the network
Multi-agent workflows relying on ServerConfig.auth_token for access control

Discovery Timeline

2026-08-25 - CVE-2026-55528 published to NVD
2026-08-25 - Last updated in NVD database
Fix released in PraisonAI version 1.6.58 via GitHub Release v4.6.58 and documented in GHSA-7g3p-92qq-8wvh

Technical Details for CVE-2026-55528

Vulnerability Analysis

The vulnerability resides in the ASGI application constructor AgentServer._create_app inside src/praisonai-agents/praisonaiagents/server/server.py. ServerConfig accepts an auth_token value intended to gate access to server routes. However, the route handlers never call an authorization function to compare incoming request headers against this token. As a result, the token is inert configuration.

An attacker with network reachability to the AgentServer can enumerate exposed routes and invoke them directly. Documented capabilities include subscribing to agent event streams, publishing messages into the multi-agent bus, and performing other server actions that were intended to be restricted to authenticated clients. Because agent servers commonly orchestrate large language model calls, tool invocations, and inter-agent messaging, unauthorized publish access provides a foothold for prompt injection, task hijacking, and data-flow manipulation within downstream agents.

Root Cause

The root cause is a missing authentication check [CWE-306]. ServerConfig.auth_token was surfaced as an API but never consumed by request handlers. The fix in commit 2f9677a introduces an _authorise_request helper that validates both Authorization: Bearer <token> and X-Auth-Token headers when a token is configured, and returns True only if the presented value matches.

Attack Vector

Exploitation requires only network access to the AgentServer endpoint. No credentials, user interaction, or prior privileges are needed. An attacker sends HTTP requests directly to server routes without any authentication headers, and the server accepts them regardless of the auth_token setting.

python

# Security patch: _authorise_request added to AgentServer
# Source: https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1

def _authorise_request(self, request) -> bool:
    """Verify bearer token when auth_token is configured."""
    token = self.config.auth_token
    if not token:
        return True
    auth = request.headers.get("Authorization", "")
    if auth.startswith("Bearer ") and auth[7:] == token:
        return True
    return request.headers.get("X-Auth-Token") == token

def _create_app(self):
    """Create the ASGI application."""

The companion patch also hardens file_memory.py by rejecting path traversal sequences in user_id values used as directory names, closing a related input-validation gap.

Detection Methods for CVE-2026-55528

Indicators of Compromise

HTTP requests to AgentServer routes lacking Authorization or X-Auth-Token headers that still receive 200 responses
Unexpected publish or subscribe operations on agent event channels from external IP addresses
Agent workflows executing tasks or tool calls that were not initiated by known clients
Access log entries showing route enumeration against the PraisonAI server port

Detection Strategies

Inspect PraisonAI access logs for successful requests missing bearer or X-Auth-Token headers
Compare deployed praisonaiagents package version against 1.6.58 using pip show praisonaiagents
Audit source for absence of an _authorise_request call in the request pipeline of AgentServer
Correlate agent task execution events with authenticated client sessions to identify orphaned activity

Monitoring Recommendations

Route AgentServer traffic through a reverse proxy that logs full request headers for retrospective analysis
Alert on requests originating from source addresses outside the expected orchestration subnet
Monitor for spikes in publish or subscribe operations that do not correspond to known workloads
Track outbound calls from agents to external LLM APIs or tools to catch attacker-driven task injection

How to Mitigate CVE-2026-55528

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.58 or later using pip install --upgrade praisonaiagents
Restrict network exposure of AgentServer endpoints to trusted management networks only
Rotate any auth_token values that were in use during the vulnerable window, as they may have been observed by clients that bypassed validation
Review agent activity logs since deployment for unauthorized publish, subscribe, or tool-invocation events

Patch Information

The fix is delivered in praisonaiagents version 1.6.58. See the upstream GitHub Commit that adds _authorise_request and the corresponding GitHub Release v4.6.58. Full technical detail is available in GHSA-7g3p-92qq-8wvh.

Workarounds

Place the AgentServer behind a reverse proxy that enforces bearer-token or mTLS authentication before requests reach the application
Bind the AgentServer to 127.0.0.1 or a private interface and require SSH tunneling or VPN access
Use host-based firewall rules (iptables, nftables, cloud security groups) to restrict inbound access to known client IPs
Disable the AgentServer entirely in deployments where it is not required until the upgrade to 1.6.58 is applied

bash

# Configuration example: upgrade and restrict network exposure
pip install --upgrade 'praisonaiagents>=1.6.58'

# Example nginx reverse proxy enforcing bearer token before PraisonAI
# location / {
#     if ($http_authorization != "Bearer <rotated-token>") { return 401; }
#     proxy_pass http://127.0.0.1:8000;
# }