CVE-2026-55539: PraisonAI Jobs API Auth Bypass Vulnerability

CVE-2026-55539 Overview

CVE-2026-55539 is a missing authentication vulnerability [CWE-306] in PraisonAI, a multi-agent teams system. The flaw exists in the Jobs API create_app function, which mounts the /api/v1/runs endpoint without any authentication middleware. Any network-reachable caller can submit jobs, read job results, cancel runs, or delete jobs using operator credentials. The issue affects versions prior to 4.6.51 and is remediated in version 4.6.58 through the addition of PRAISONAI_JOBS_API_KEY middleware that enforces Authorization or X-API-Key headers.

Critical Impact
Unauthenticated network attackers can execute jobs with operator privileges, exfiltrate results from prior runs, and disrupt agent workflows by cancelling or deleting jobs.

Affected Products

PraisonAI versions prior to 4.6.51
PraisonAI Jobs API (/api/v1/runs endpoint)
Deployments exposing the multi-agent server to untrusted networks

Discovery Timeline

2026-08-25 - CVE-2026-55539 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55539

Vulnerability Analysis

PraisonAI exposes a Jobs API responsible for submitting, monitoring, and managing multi-agent execution runs. The create_app function registered the /api/v1/runs route group without attaching authentication middleware. As a result, any client that could reach the API socket could invoke privileged operations equivalent to those available to a legitimate operator.

The endpoint surface includes job submission, result retrieval, run cancellation, and job deletion. Because PraisonAI orchestrates multi-agent workloads that often integrate with LLM providers, tools, and internal data sources, an attacker abusing this API can trigger arbitrary agent tasks, harvest sensitive results, and disrupt production pipelines. The classification maps to CWE-306: Missing Authentication for Critical Function.

Root Cause

The application constructed its ASGI app without a request-authorization gate on job routes. The upstream fix introduces a _authorise_request helper that validates a bearer token from the Authorization header or a token supplied via X-Auth-Token, and equivalent PRAISONAI_JOBS_API_KEY enforcement for the Jobs API.

Attack Vector

Exploitation requires only network reachability to the Jobs API. No credentials, prior access, or user interaction are needed. An attacker sends unauthenticated HTTP requests to /api/v1/runs to submit, read, cancel, or delete jobs.

python

# Security patch: server-side authorization helper introduced in the fix
# Source: https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1

def _authorise_request(self, request) -> bool:
    """Verify bearer token when auth_token is configured."""
    token = self.config.auth_token
    if not token:
        return True
    auth = request.headers.get("Authorization", "")
    if auth.startswith("Bearer ") and auth[7:] == token:
        return True
    return request.headers.get("X-Auth-Token") == token

The companion patch also hardens input handling in memory storage by rejecting path traversal in user_id values before they are used as directory names:

python

# Source: https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1

@staticmethod
def _sanitise_user_id(user_id: str) -> str:
    """Reject path traversal in user_id before using it as a directory name."""
    if not user_id or not isinstance(user_id, str):
        return "default"
    if ".." in user_id or "/" in user_id or "\\" in user_id:
        raise ValueError("user_id must not contain path separators or parent references")
    safe = user_id.strip()
    return safe or "default"

Detection Methods for CVE-2026-55539

Indicators of Compromise

Unauthenticated HTTP requests to /api/v1/runs and its subpaths that lack an Authorization or X-API-Key header.
Unexpected job submissions, cancellations, or deletions in PraisonAI operator logs.
Outbound requests from PraisonAI worker processes to LLM or tool endpoints that do not correlate with sanctioned workflows.

Detection Strategies

Inspect reverse-proxy and application access logs for POST, DELETE, or GET requests to /api/v1/runs originating from unexpected source IPs.
Baseline job submission rates and alert on spikes or off-hours activity against the Jobs API.
Deploy runtime monitoring on the PraisonAI host to identify child processes spawned by unattributed job runs.

Monitoring Recommendations

Forward PraisonAI application and web-server logs to a centralized analytics platform for correlation with network telemetry.
Track the running PraisonAI version through software inventory to identify hosts still exposing the unauthenticated endpoint.
Alert on any Jobs API 2xx response served to a request that did not present a valid API key after the patch is applied.

How to Mitigate CVE-2026-55539

Immediate Actions Required

Upgrade PraisonAI to version 4.6.58 or later, which enforces PRAISONAI_JOBS_API_KEY middleware on the Jobs API.
Set a strong, unique value for PRAISONAI_JOBS_API_KEY and distribute it only to authorized operators and services.
Restrict network exposure of the Jobs API to trusted management networks using firewall or service-mesh policies.

Patch Information

The fix is available in the PraisonAI v4.6.58 release. Technical remediation details are documented in the GitHub Security Advisory GHSA-2jgc-f764-c5r2 and implemented in the upstream commit.

Workarounds

Place PraisonAI behind an authenticating reverse proxy that requires a bearer token or mutual TLS for /api/v1/runs.
Bind the PraisonAI service to 127.0.0.1 and access it only through an authenticated tunnel until the upgrade is completed.
Disable the Jobs API entirely in deployments that do not require remote job submission.

bash

# Configuration example: enforce API key middleware after upgrading to 4.6.58
export PRAISONAI_JOBS_API_KEY="$(openssl rand -hex 32)"

# Example client call using the configured key
curl -H "Authorization: Bearer ${PRAISONAI_JOBS_API_KEY}" \
     https://praisonai.internal.example.com/api/v1/runs