CVE-2026-57132: PraisonAI Authentication Bypass Vulnerability

CVE-2026-57132 Overview

CVE-2026-57132 is an authentication bypass vulnerability in PraisonAI, a multi-agent teams system maintained by MervinPraison. Versions prior to 4.6.62 allow requests to /api/v1/agents/{id}/invoke to bypass CALL_SERVER_TOKEN authentication when the PRAISONAI_CALL_AUTH environment variable is set to disabled. The verify_token function accepts unauthenticated requests under this configuration, exposing registered agents and their connected tools or private context to any network attacker. The issue is tracked under [CWE-287: Improper Authentication] and is resolved in release 4.6.62.

Critical Impact

Unauthenticated remote attackers can invoke registered PraisonAI agents, access connected tools, and reach private context data on deployments that use the documented opt-out.

Affected Products

• PraisonAI versions prior to 4.6.62
• Deployments configured with PRAISONAI_CALL_AUTH set to disabled
• Container images built from docker/Dockerfile.chat and docker/Dockerfile.dev pinned to praisonai>=4.6.60

Discovery Timeline

• 2026-09-14 - CVE-2026-57132 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-57132

Vulnerability Analysis

PraisonAI exposes an HTTP endpoint at /api/v1/agents/{id}/invoke that allows callers to execute registered agents. Access to this endpoint is gated by the verify_token dependency, which is expected to validate the CALL_SERVER_TOKEN value on every request. When operators set PRAISONAI_CALL_AUTH to disabled, verify_token returns success without enforcing the token check. This behavior removes the only authentication control protecting agent invocation.

Because PraisonAI agents can bind to tools, data sources, and stored context, an unauthenticated caller can drive agent behavior and reach downstream systems. The vulnerability is network-reachable and requires no user interaction, making any exposed instance a direct target.

Root Cause

The root cause is an insecure opt-out design in the authentication middleware. Rather than restricting the disabled state to explicit development-only paths, verify_token short-circuits on the global flag and accepts all inbound requests. This is a classic [CWE-287] improper authentication pattern where a configuration toggle bypasses the security control instead of scoping it.

Attack Vector

An attacker on the network sends an HTTP request to /api/v1/agents/{id}/invoke with an arbitrary or empty CALL_SERVER_TOKEN header. If the target deployment has PRAISONAI_CALL_AUTH disabled, the request executes the specified agent and returns its output. The attacker can enumerate agent IDs, invoke tool-enabled agents, and exfiltrate private context supplied to those agents.

# docker/Dockerfile.chat patch — Release v4.6.62
 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.60" \
+    "praisonai>=4.6.62" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"

Source: GitHub Commit 2a855c4

Detection Methods for CVE-2026-57132

Indicators of Compromise

• HTTP requests to /api/v1/agents/{id}/invoke lacking a valid CALL_SERVER_TOKEN header that receive successful responses.
• Environment variable PRAISONAI_CALL_AUTH set to a disabled value in running containers or process environments.
• Unexpected agent invocations from unfamiliar source IPs, particularly against agents bound to sensitive tools or data connectors.

Detection Strategies

• Inventory all PraisonAI deployments and confirm the installed package version is 4.6.62 or later using pip show praisonai.
• Audit container build files, Helm charts, and orchestration manifests for PRAISONAI_CALL_AUTH values that disable authentication.
• Review reverse proxy and application logs for requests to the agent invoke path and correlate against expected client identities.

Monitoring Recommendations

• Alert on any 200-status response to /api/v1/agents/{id}/invoke where the request omits the CALL_SERVER_TOKEN header.
• Baseline normal invocation volume per agent ID and flag deviations that indicate enumeration or abuse.
• Forward PraisonAI application logs to a centralized logging or SIEM platform for retention and correlation with network telemetry.

How to Mitigate CVE-2026-57132

Immediate Actions Required

• Upgrade PraisonAI to version 4.6.62 or later on all hosts and container images.
• Remove or set PRAISONAI_CALL_AUTH to its enabled state so verify_token enforces CALL_SERVER_TOKEN validation.
• Rotate the CALL_SERVER_TOKEN value and any credentials or API keys accessible to invoked agents.
• Restrict network exposure of the PraisonAI service to trusted client subnets until the upgrade is verified.

Patch Information

The maintainer released the fix in PraisonAI 4.6.62. Container image definitions in docker/Dockerfile.chat and docker/Dockerfile.dev were updated to pin praisonai>=4.6.62. See the GitHub Release v4.6.62, the GitHub Security Advisory GHSA-8ccj-p46r-jwqq, and the upstream commit for full details.

Workarounds

• Do not set PRAISONAI_CALL_AUTH to a disabled value in any production or internet-reachable environment.
• Place the PraisonAI API behind an authenticating reverse proxy or service mesh that enforces mutual TLS or bearer token validation independent of the application flag.
• Apply network policies or firewall rules that limit /api/v1/agents/* access to known internal clients until the upgrade completes.

# Upgrade PraisonAI and verify installed version
pip install --upgrade "praisonai>=4.6.62"
pip show praisonai | grep -i version

# Ensure the auth flag is not disabled (unset or set to a truthy value)
unset PRAISONAI_CALL_AUTH
# or
export PRAISONAI_CALL_AUTH=enabled