CVE-2026-57134

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without...

CVE-2026-57134

PraisonAI (npm package praisonai) is a multi-agent teams system. The MCPSecurity.evaluatePolicy() function in src/praisonai-ts/src/mcp/security.ts only invokes the configured credential validator when the AuthMethod is api-key or bearer. For basic and oauth policies, any non-empty Authorization h...

CVE-2026-57134: Improper Authentication

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without...