CVE-2026-61435: PraisonAI Authentication Bypass Vulnerability

CVE-2026-61435 Overview

CVE-2026-61435 is an authentication bypass vulnerability in PraisonAI versions before 4.6.78. The flaw resides in the Call API agent invocation endpoints implemented in src/praisonai/praisonai/api/agent_invoke.py. When operators configure PRAISONAI_CALL_AUTH=disabled, the software attempts to restrict this opt-out to localhost binding. However, it derives the bind host from request.url.hostname, which is parsed from the client-controlled HTTP Host header. A remote, unauthenticated attacker who can reach the service can forge a Host: 127.0.0.1 header and bypass the localhost restriction. This allows enumeration and invocation of registered agents without any credentials.

Critical Impact

Remote unauthenticated attackers can list and invoke registered AI agents by spoofing the HTTP Host header, gaining unauthorized access to agent execution capabilities.

Affected Products

• PraisonAI versions before 4.6.78
• Deployments with PRAISONAI_CALL_AUTH=disabled configured
• Instances exposing the Call API agent invocation endpoints over the network

Discovery Timeline

• 2026-07-15 - CVE-2026-61435 published to NVD
• 2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61435

Vulnerability Analysis

The vulnerability is classified under [CWE-287] Improper Authentication. PraisonAI exposes agent management endpoints through a FastAPI/Starlette-based application. When PRAISONAI_CALL_AUTH=disabled is set, the developers intended to make this opt-out safe by restricting it to loopback traffic only. The safeguard reads the hostname from the parsed request URL and compares it against localhost values.

The design assumes the URL hostname reflects the actual network interface receiving the request. In reality, frameworks derive request.url.hostname from the incoming Host header, which is fully controlled by the HTTP client. An attacker sending traffic to any reachable interface can override the value, defeating the check.

Root Cause

The root cause is trusting a client-supplied HTTP header for a security decision. The check in agent_invoke.py uses request.url.hostname as a proxy for the bound listening interface. The correct approach is to inspect the socket-level bind address or the transport-layer client information rather than the parsed request URL.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker with network reachability to a vulnerable PraisonAI instance sends HTTP requests to GET /api/v1/agents and POST /api/v1/agents/{agent_id}/invoke while setting the Host header to 127.0.0.1. The application accepts the spoofed header, evaluates the request as originating from localhost, and permits agent listing and invocation without authentication.

POST /api/v1/agents/{agent_id}/invoke HTTP/1.1
Host: 127.0.0.1
Content-Type: application/json

{"input": "..."}

Refer to the GitHub Security Advisory GHSA-2gpf-2492-q9jh and the VulnCheck Advisory on PraisonAI for additional technical detail.

Detection Methods for CVE-2026-61435

Indicators of Compromise

• HTTP requests to /api/v1/agents or /api/v1/agents/{agent_id}/invoke where the Host header value is 127.0.0.1, localhost, or ::1 but the source IP is external.
• Unexpected agent invocation events in PraisonAI logs originating from non-authenticated sessions.
• Deployments running PraisonAI versions earlier than 4.6.78 with the environment variable PRAISONAI_CALL_AUTH=disabled set.

Detection Strategies

• Correlate the HTTP Host header against the true remote address at the reverse proxy or load balancer layer, and alert on mismatches.
• Enable web server access logs that record both the client IP and the Host header for all traffic to PraisonAI API paths.
• Inspect configuration management inventories for PRAISONAI_CALL_AUTH set to disabled on network-exposed hosts.

Monitoring Recommendations

• Monitor PraisonAI application logs for agent invocation activity outside expected operator patterns or business hours.
• Track outbound network activity from PraisonAI hosts, since invoked agents may perform attacker-directed actions.
• Alert on any anomalous spikes in requests to the /api/v1/agents enumeration endpoint.

How to Mitigate CVE-2026-61435

Immediate Actions Required

• Upgrade PraisonAI to version 4.6.78 or later, which contains the authentication fix.
• Remove or unset PRAISONAI_CALL_AUTH=disabled in production deployments and require authentication for all agent invocation endpoints.
• Restrict network exposure of PraisonAI services to trusted management networks until patching is complete.

Patch Information

The maintainers addressed the issue in PraisonAI 4.6.78. Related container image updates were shipped in the Docker files bumping the minimum installed package version, and the upstream deps.py module was refactored to correctly validate requests. Review the GitHub Commit Update and the GitHub Commit Fix for reference.

Example Docker image change bumping the dependency baseline:

 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.60" \
+    "praisonai>=4.6.62" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"

Source: GitHub Commit 2a855c4

Workarounds

• Bind the PraisonAI service explicitly to the loopback interface (127.0.0.1) at the socket level rather than relying on the application's Host-header check.
• Deploy a reverse proxy that strips or validates the incoming Host header before forwarding traffic to PraisonAI.
• Enforce network-level access control lists that block external clients from reaching the agent invocation endpoints.

# Example: enforce loopback-only binding via reverse proxy (nginx)
server {
    listen 127.0.0.1:8080;
    server_name _;
    location /api/v1/agents {
        # Reject spoofed Host headers
        if ($http_host !~* "^(127\.0\.0\.1|localhost)(:[0-9]+)?$") {
            return 403;
        }
        proxy_pass http://127.0.0.1:8000;
    }
}