PraisonAI - Authentication Bypass

PraisonAI 2.5.6 to 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server. id: CVE-2026-44338 info: name: PraisonAI -...

CVE-2026-44338-Lab

Laboratorio de omisión de autenticación CVE-2026-44338 en PraisonAI Laboratorio Docker local para CVE-2026-44338, una omisión de autenticación en el servidor API Flask heredado de PraisonAI. Este laboratorio demuestra la condición de acceso no autenticado en las rutas de la API heredada. De forma...

CVE-2026-55529

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:53+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wj6g-v78p-6fx3...

CVE-2026-55526

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:46+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x44h-65qv-cw74...

CVE-2026-55534

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:44+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7ww9-85pg-cv4x...

CVE-2026-55540

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:37+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8 2026-08-25 18:13:47+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtwgc6uuyp2g 2026-08-25...

CVE-2026-55527

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:24+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gxmw-5f7x-6g22...

CVE-2026-55539

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:21+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2jgc-f764-c5r2...

CVE-2026-55536

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:14+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g6r-q6gw-w8fg 2026-08-25 18:08:14+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtwfybfgai2b 2026-08-25...

CVE-2026-55539

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...

CVE-2026-55536

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

CVE-2026-55533

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...

CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...

GHSA-6G6R-Q6GW-W8FG PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...

CVE-2026-55536

PraisonAI , a multi-agent teams system, contains a patch bypass (of CVE-2026-40289) in its Browser Server _handle_connection() method. The origin validation uses re.match() with the unanchored pattern chrome-extension://[a-z0-9]{32}, so extra trailing characters are ignored, allowing an attacker ...

CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

GHSA-PVPH-5J39-V8QC PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Summary The PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...

EUVD-2026-65544

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...