EUVD-2026-44641

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header...

Duplicate Advisory: PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2gpf-2492-q9jh. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints...

CVE-2026-61435

PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints src/praisonai/praisonai/api/agentinvoke.py when PRAISONAICALLAUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host fr...

PT-2026-60138

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78 Description An authentication bypass exists in the agent invocation endpoints when the PRAISONAI CALL AUTH variable is set to disabled. The system attempts to restrict this disabled authentication mode to...