CVE-2026-57125: PraisonAI Remote Code Execution Vulnerability

CVE-2026-57125 Overview

CVE-2026-57125 is a critical vulnerability in PraisonAI, a multi-agent teams system for orchestrating language model agents. The flaw resides in the unauthenticated POST /api/v1/runs Jobs API, which accepts attacker-controlled agent_yaml input. The approve field can mark execute_command as YAML-approved before the @require_approval decorator validates critical tools. This chain allows a remote, unauthenticated caller to instruct a configured language model agent to invoke arbitrary operating-system commands. The vulnerability is tracked as [CWE-306: Missing Authentication for Critical Function] and is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59.

Critical Impact
Remote attackers can achieve unauthenticated command execution on hosts running vulnerable PraisonAI deployments with no operator interaction required.

Affected Products

PraisonAI versions prior to 4.6.59
praisonaiagents versions prior to 1.6.59
Deployments exposing the /api/v1/runs Jobs API endpoint

Discovery Timeline

2026-09-14 - CVE-2026-57125 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-57125

Vulnerability Analysis

PraisonAI exposes a Jobs API at POST /api/v1/runs that accepts a YAML agent definition through the agent_yaml field. The API performs no authentication, allowing any network-reachable client to submit agent configurations. Within the submitted YAML, an approve field can pre-mark tools as authorized, bypassing the @require_approval guard that would otherwise gate execution of dangerous tools such as execute_command.

The result is a full exploitation chain: an attacker submits a crafted YAML payload that pre-approves execute_command, then instructs the agent to run arbitrary shell commands. The language model agent executes those commands with the privileges of the PraisonAI process. No credentials, user interaction, or prior foothold is required.

Root Cause

Two defects combine to produce the vulnerability. First, the Jobs API endpoint lacks authentication controls. Second, the approval registry treats YAML-declared approvals as authoritative without cross-checking the tool's risk classification. The is_yaml_approved method returned True for any tool listed in _yaml_approved_tools, including tools flagged as critical risk.

Attack Vector

Exploitation occurs over the network against any exposed PraisonAI instance. An attacker sends an HTTP POST request containing an agent_yaml payload that declares execute_command in the approve list and provides a task prompt directing the agent to invoke that tool with attacker-chosen arguments.

python

# Security patch in src/praisonai-agents/praisonaiagents/approval/registry.py
# Fixes YAML-approval bypass for critical-risk tools

    def is_yaml_approved(self, tool_name: str) -> bool:
        try:
-            return tool_name in self._yaml_approved_tools.get()
+            if tool_name not in self._yaml_approved_tools.get():
+                return False
        except LookupError:
            return False
+        if self.get_risk_level(tool_name) == "critical":
+            return False
+        return True

    # ── Env-var check ────────────────────────────────────────────────────

Source: PraisonAI commit 2adfe7e

Detection Methods for CVE-2026-57125

Indicators of Compromise

Unauthenticated HTTP POST requests to /api/v1/runs from unexpected source IPs
Agent YAML payloads containing an approve list that references execute_command or other critical tools
Child processes such as sh, bash, cmd.exe, or powershell.exe spawned by the PraisonAI Python process
Outbound network connections initiated by PraisonAI workers to attacker-controlled infrastructure

Detection Strategies

Inspect PraisonAI application logs for /api/v1/runs invocations that succeed without authentication headers
Alert on process ancestry where a language model agent process spawns operating-system shells or interpreters
Perform egress monitoring for anomalous outbound traffic originating from PraisonAI hosts

Monitoring Recommendations

Enable verbose logging of accepted agent_yaml payloads and the tool invocations they trigger
Baseline normal Jobs API request volume and alert on spikes or requests from unknown sources
Correlate API request timestamps with host-level command execution telemetry to identify chained abuse

How to Mitigate CVE-2026-57125

Immediate Actions Required

Upgrade to praisonai 4.6.59 and praisonaiagents 1.6.59 without delay
Remove PraisonAI Jobs API endpoints from public network exposure until patching completes
Audit historical Jobs API logs for suspicious agent_yaml submissions containing execute_command in the approve list
Rotate any credentials or secrets accessible to the PraisonAI process account

Patch Information

The fix is available in PraisonAI Release v4.6.59 and detailed in GitHub Security Advisory GHSA-4869-x4pr-q22x. The patch hardens is_yaml_approved in registry.py so critical-risk tools cannot be authorized through YAML alone, and introduces optional SSE authentication in mcp_security.py via MCP_SSE_AUTH_TOKEN and MCP_SSE_ALLOWED_ORIGINS environment variables.

Workarounds

Bind the PraisonAI service to 127.0.0.1 and front it with an authenticating reverse proxy
Enforce network-layer access control lists that restrict the Jobs API to trusted operator hosts
Set MCP_SSE_AUTH_TOKEN and MCP_SSE_ALLOWED_ORIGINS after upgrading to require authentication for SSE endpoints
Run PraisonAI under a least-privilege service account inside a container with no shell utilities available

bash

# Configuration example: enforce authentication and origin allowlisting after upgrade
export MCP_SSE_AUTH_TOKEN="$(openssl rand -hex 32)"
export MCP_SSE_ALLOWED_ORIGINS="https://praisonai.internal.example.com"

# Restrict the Jobs API to loopback and require an upstream authenticating proxy
export PRAISONAI_BIND_ADDRESS="127.0.0.1"