CVE-2026-55536: PraisonAI Authentication Bypass Vulnerability

CVE-2026-55536 Overview

PraisonAI, a multi-agent teams system, contains a broken access control vulnerability in its Browser Server component. Prior to version 4.6.58, the _handle_connection() function validates Chrome extension origins using re.match() with the unanchored regular expression chrome-extension://[a-z0-9]{32}. Because re.match() only anchors at the start of the string, extra trailing characters bypass the check before websocket.accept() is called. Attackers can send start_session commands and drive unauthorized browser automation from arbitrary origins. The issue is fixed in praisonai 4.6.58.

Critical Impact
Remote, unauthenticated attackers can bypass origin validation on the Browser Server WebSocket endpoint and hijack browser automation sessions.

Affected Products

PraisonAI versions prior to 4.6.58
PraisonAI Browser Server component (_handle_connection())
Deployments exposing the PraisonAI WebSocket interface to untrusted networks

Discovery Timeline

2026-08-25 - CVE-2026-55536 published to NVD
2026-08-25 - Last updated in NVD database
v4.6.58 - Fix released via GitHub Release v4.6.58 and GHSA-6g6r-q6gw-w8fg

Technical Details for CVE-2026-55536

Vulnerability Analysis

The flaw is a classic improper access control weakness [CWE-284] caused by a misused regular expression. Python's re.match() anchors the pattern only at the beginning of the input string, not at the end. The Browser Server passes the incoming Origin header through re.match(r"chrome-extension://[a-z0-9]{32}", origin), which returns a match object as long as the string starts with a valid extension identifier. Any trailing characters, including additional path components or query strings, are ignored. The server then calls websocket.accept() and processes attacker-supplied start_session commands.

Root Cause

The root cause is the use of an unanchored regex without a terminating $ or explicit length check. A well-formed but attacker-controlled origin such as chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.evil.example/x satisfies re.match(). The validator should use re.fullmatch() or anchor the expression with \Z, and additionally verify that the origin identifier belongs to a known extension.

Attack Vector

An unauthenticated remote attacker connects to the PraisonAI Browser Server WebSocket endpoint and supplies a crafted Origin header. After the bypassed origin check, the attacker issues start_session and subsequent automation commands. This grants control over browser automation, enabling data exfiltration from authenticated sessions, arbitrary navigation, and command execution within the automation surface.

python

# Security patch excerpt from server.py — bearer token authorization added
# Source: https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1

def _authorise_request(self, request) -> bool:
    """Verify bearer token when auth_token is configured."""
    token = self.config.auth_token
    if not token:
        return True
    auth = request.headers.get("Authorization", "")
    if auth.startswith("Bearer ") and auth[7:] == token:
        return True
    return request.headers.get("X-Auth-Token") == token

Detection Methods for CVE-2026-55536

Indicators of Compromise

WebSocket connections to the PraisonAI Browser Server with Origin headers matching chrome-extension://[a-z0-9]{32} followed by unexpected characters, paths, or query strings.
Unexpected start_session commands from external IP addresses on the Browser Server port.
Browser automation activity originating outside authorized Chrome extension identifiers.

Detection Strategies

Inspect Browser Server access logs for Origin values whose length exceeds the fixed chrome-extension://<32-char-id> format.
Alert on new external clients successfully establishing WebSocket sessions to PraisonAI hosts.
Correlate outbound browser automation traffic with expected extension IDs in an allowlist.

Monitoring Recommendations

Enable verbose logging of WebSocket handshake headers on PraisonAI hosts.
Forward PraisonAI application and network logs to a central analytics platform for anomaly detection.
Monitor process trees for browser automation invocations that lack a corresponding local user session.

How to Mitigate CVE-2026-55536

Immediate Actions Required

Upgrade PraisonAI to version 4.6.58 or later immediately.
Restrict network exposure of the Browser Server WebSocket endpoint to trusted hosts only.
Configure the auth_token option so _authorise_request() enforces bearer-token authentication on all requests.
Rotate any credentials or session data handled by the affected automation instances.

Patch Information

The fix is delivered in praisonai 4.6.58. The remediation commit hardens input validation and adds bearer-token authorization for server requests. See the GitHub Commit Update, the GitHub Release v4.6.58, and the GitHub Security Advisory GHSA-6g6r-q6gw-w8fg.

Workarounds

Bind the Browser Server to 127.0.0.1 and require SSH tunneling or a VPN for administrative access.
Place a reverse proxy in front of PraisonAI that validates the Origin header with a fully anchored expression and rejects non-matching requests.
Disable the Browser Server component if browser automation is not required in the deployment.

bash

# Example: restrict access to the PraisonAI Browser Server port with iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP

# Upgrade PraisonAI to the patched release
pip install --upgrade "praisonai>=4.6.58"