CVE-2026-57131

PraisonAI (a Python multi-agent framework on PyPI) ships a standalone async-jobs HTTP server whose /api/v1/runs/... endpoints are entirely unauthenticated prior to version 4.6.58 . The root cause is a missing authentication layer: create_app adds only CORS middleware (which lists Authorization in...

CVE-2026-57131: Improper Control of Generation of Code

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.createapp mounts praisonai.jobs.router.createrouter under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read job...