CVE-2026-55533: PraisonAI Authentication Bypass Vulnerability

CVE-2026-55533 Overview

CVE-2026-55533 is an authentication bypass vulnerability [CWE-287] in PraisonAI, a multi-agent teams system. The flaw exists in the create_auth_middleware() function in versions prior to 4.6.58. The middleware permits requests to proceed when auth=api-key is configured without the PRAISONAI_API_KEY environment variable, or when JWT authentication is configured without PRAISONAI_JWT_SECRET. An externally bound Recipe server can accept unauthenticated POST /v1/recipes/run requests even though authentication appears enabled. The issue is resolved in PraisonAI version 4.6.58.

Critical Impact
Remote attackers can invoke Recipe server endpoints without credentials, executing arbitrary agent workflows on exposed PraisonAI deployments.

Affected Products

PraisonAI versions prior to 4.6.58
PraisonAI Recipe server component (praisonaiagents.server)
Deployments configured with auth=api-key or JWT authentication modes

Discovery Timeline

2026-08-25 - CVE-2026-55533 published to NVD
2026-08-25 - Last updated in NVD database
v4.6.58 - PraisonAI releases patched version resolving the authentication bypass

Technical Details for CVE-2026-55533

Vulnerability Analysis

The defect resides in PraisonAI's authentication middleware factory create_auth_middleware(). When operators configure auth=api-key, the middleware is expected to reject requests lacking a valid API key. When JWT authentication is selected, the middleware should validate tokens against a shared secret. Neither path fails closed when its corresponding secret environment variable is unset.

Instead of terminating startup or rejecting all requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET is missing, the middleware treats the empty secret as a wildcard and allows requests through. This produces a silent-fail configuration: administrators believe authentication is enforced because they set auth=api-key, but the server accepts every unauthenticated request.

The primary exposure is the Recipe execution endpoint POST /v1/recipes/run, which runs multi-agent workflows and can trigger downstream tool calls, file access, and network egress from the host.

Root Cause

The root cause is missing authentication for a critical function [CWE-287]. The middleware conflates "authentication mode configured" with "authentication enforceable," and does not validate that the required secret material is loaded before binding to the network.

Attack Vector

An unauthenticated attacker with network reachability to the Recipe server sends a crafted POST request to /v1/recipes/run. Because the middleware short-circuits when the server-side secret is empty, the request bypasses the authentication check and executes the requested recipe. The upstream fix hardens request authorization and input handling in the server module.

python

# Patched authorization check added in v4.6.58
# Source: https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1

def _authorise_request(self, request) -> bool:
    """Verify bearer token when auth_token is configured."""
    token = self.config.auth_token
    if not token:
        return True
    auth = request.headers.get("Authorization", "")
    if auth.startswith("Bearer ") and auth[7:] == token:
        return True
    return request.headers.get("X-Auth-Token") == token

The same commit also adds a _sanitise_user_id() helper in file_memory.py that rejects path traversal sequences in user_id inputs before they are used as directory names, hardening related components:

python

# Source: https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1

@staticmethod
def _sanitise_user_id(user_id: str) -> str:
    """Reject path traversal in user_id before using it as a directory name."""
    if not user_id or not isinstance(user_id, str):
        return "default"
    if ".." in user_id or "/" in user_id or "\\" in user_id:
        raise ValueError("user_id must not contain path separators or parent references")
    safe = user_id.strip()
    return safe or "default"

Detection Methods for CVE-2026-55533

Indicators of Compromise

Successful HTTP 200 responses to POST /v1/recipes/run requests that carry no Authorization or X-Auth-Token header.
Recipe execution logs originating from unexpected external source IP addresses on the PraisonAI server port.
PraisonAI processes spawning outbound network connections or tool invocations without a preceding authenticated session in access logs.

Detection Strategies

Inspect reverse proxy and application logs for requests to /v1/recipes/run where authentication headers are missing or malformed.
Verify at deployment time whether PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET is set when the corresponding auth mode is enabled; treat unset secrets as a critical misconfiguration.
Baseline expected recipe invocation volume and alert on anomalous spikes or invocations from non-allowlisted callers.

Monitoring Recommendations

Forward PraisonAI server access logs and environment configuration state to a centralized logging platform for correlation.
Monitor process telemetry on hosts running PraisonAI for unexpected child processes, file writes, or outbound connections initiated by the agent runtime.
Track the installed PraisonAI package version across managed hosts and alert when versions older than 4.6.58 are detected.

How to Mitigate CVE-2026-55533

Immediate Actions Required

Upgrade PraisonAI to version 4.6.58 or later on all hosts running the Recipe server.
Restrict network exposure of the PraisonAI server so it is not reachable from untrusted networks until patched.
Rotate any API keys or JWT secrets that may have been in use during the exposure window and audit recipe execution logs for unauthorized invocations.

Patch Information

The fix is delivered in PraisonAI v4.6.58. See the GitHub Security Advisory GHSA-gfq8-hmph-9gjv and the upstream commit for the authorization hardening and input validation changes.

Workarounds

Confirm PRAISONAI_API_KEY is set to a strong random value before starting the server when using auth=api-key; confirm PRAISONAI_JWT_SECRET is set when using JWT mode.
Place PraisonAI behind an authenticated reverse proxy or service mesh that enforces its own bearer-token check on /v1/recipes/run.
Bind the Recipe server to 127.0.0.1 or a private interface only, and require SSH tunneling or VPN for administrative access.

bash

# Verify required secrets are present before launching PraisonAI
if [ -z "${PRAISONAI_API_KEY}" ]; then
  echo "PRAISONAI_API_KEY is not set - refusing to start" >&2
  exit 1
fi

# Upgrade to the fixed release
pip install --upgrade 'praisonai>=4.6.58'

# Restrict network exposure
export PRAISONAI_HOST=127.0.0.1
export PRAISONAI_PORT=8000