CVE-2026-55533

PraisonAI is a multi-agent teams system. Prior to version 4.6.58 , the create_auth_middleware() function in the Recipe server exhibits a fail-open behavior: when auth=api-key is configured but the PRAISONAI_API_KEY environment variable is unset, or when JWT authentication is configured but PRAISO...

CVE-2026-55533 PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...

EUVD-2026-65523

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...