CVE-2026-57134: PraisonAI Authentication Bypass Vulnerability

CVE-2026-57134 Overview

PraisonAI is a multi-agent teams system that provides Model Context Protocol (MCP) integration for AI agents. CVE-2026-57134 is an authentication bypass vulnerability [CWE-287] in the MCPSecurity.evaluatePolicy() function located in src/praisonai-ts/src/mcp/security.ts. Affected versions from 1.5.1 through 1.7.1 invoke the configured credential validator only when the AuthMethod is set to api-key or bearer. Basic and OAuth authentication policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result. This allows attackers with invalid credentials to access MCP tools and resources protected by those policies.

Critical Impact

Attackers can bypass authentication on Basic and OAuth-protected MCP endpoints by supplying any non-empty Authorization header, gaining unauthorized access to protected tools and resources.

Affected Products

• PraisonAI versions 1.5.1 through 1.7.1 (praisonai-ts package)
• MCP integrations using Basic authentication policy
• MCP integrations using OAuth authentication policy

Discovery Timeline

• 2026-09-15 - CVE-2026-57134 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-57134

Vulnerability Analysis

The vulnerability resides in the MCPSecurity.evaluatePolicy() method within src/praisonai-ts/src/mcp/security.ts. The function dispatches credential validation based on the configured AuthMethod value. Only the api-key and bearer branches call the injected auth.validate() credential validator. The basic and oauth branches skip validator invocation entirely and return a successful authentication result whenever the request contains a non-empty Authorization header.

An attacker sending a request with an arbitrary Authorization: Basic anything or Authorization: Bearer anything header against an OAuth-configured policy will pass the security gate. The MCP server then exposes any tools and resources protected by that policy. Because MCP tools often wrap privileged actions such as file access, code execution, or external API calls, this bypass provides broad unauthorized access to agent-controlled capabilities.

Root Cause

The root cause is missing authentication logic in two policy branches of a switch-style dispatch. The developer wired the credential validator into the api-key and bearer paths but left the basic and oauth paths accepting any truthy header. This is a classic [CWE-287] Improper Authentication defect where the presence of a credential is confused with its validity.

Attack Vector

The attack requires network access to an MCP endpoint protected by a Basic or OAuth policy. No prior authentication, user interaction, or elevated privileges are needed. An attacker sends an HTTP request with a fabricated Authorization header and receives the same access as a legitimately authenticated caller.

# Patch reference from docker/Dockerfile.chat (Release v4.6.60)
 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.59" \
+    "praisonai>=4.6.60" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"

Source: GitHub Commit 709a0387

Detection Methods for CVE-2026-57134

Indicators of Compromise

• Successful MCP tool invocations preceded by Authorization headers containing malformed Basic or OAuth credentials.
• Access-log entries showing authenticated MCP sessions from source IPs that never completed a valid OAuth token exchange.
• Repeated requests to MCP endpoints with varying junk Authorization values that all return HTTP 200 responses.

Detection Strategies

• Inspect PraisonAI runtime logs for policy evaluations that succeed without a corresponding auth.validate() call trace.
• Audit the installed praisonai-ts package version and confirm it is at or above 1.7.2.
• Correlate MCP tool execution telemetry with upstream identity provider logs to identify authenticated sessions that lack matching IdP events.

Monitoring Recommendations

• Enable verbose request logging on MCP endpoints and forward the events to a centralized analytics platform for anomaly detection.
• Alert on any MCP tool invocation whose associated Authorization header cannot be resolved to a known principal.
• Track version drift across development, staging, and production deployments to ensure no vulnerable praisonai-ts builds remain in service.

How to Mitigate CVE-2026-57134

Immediate Actions Required

• Upgrade the praisonai-ts package to version 1.7.2 or later across all environments.
• Rebuild container images that pin PraisonAI to versions prior to 4.6.60 and redeploy from patched base images.
• Rotate any credentials, tokens, or API keys previously exposed through Basic or OAuth-protected MCP endpoints.
• Review MCP audit logs for the vulnerable window and revoke any sessions that cannot be attributed to a valid principal.

Patch Information

The fix landed in PraisonAI release v4.6.60 and praisonai-ts version 1.7.2. The patched MCPSecurity.evaluatePolicy() invokes auth.validate() for all authentication methods, including basic and oauth. Details are available in the GitHub Security Advisory GHSA-4qq2-2j2x-x62c, the GitHub Commit 709a0387, and the GitHub Release v4.6.60.

Workarounds

• Reconfigure affected MCP servers to use only api-key or bearer authentication methods until the upgrade is applied.
• Place a reverse proxy or API gateway in front of MCP endpoints to enforce credential validation independently of PraisonAI.
• Restrict network access to MCP endpoints using firewall rules or service mesh policies so only trusted clients can reach them.

# Upgrade to the patched release
npm install praisonai-ts@1.7.2

# Or for Python-based deployments
pip install --upgrade "praisonai>=4.6.60"