CVE-2026-57131

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.createapp mounts praisonai.jobs.router.createrouter under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read job...