CVE-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through...

CVE-2026-68569

Apache Tomcat contains an improper authentication flaw in the DataSourceRealm principal lookup. Under specific authentication methods—CLIENT-CERT and SPNEGO —a user could be authenticated even if they did not exist in the DataSourceRealm, effectively a fail-open condition. The issue affects 11.0....

CVE-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through...

CVE-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through...

CVE-2026-55535

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validatewebhookurl path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhookurl can later resolve to 127.0.0.1, 169.254.169.254, or another internal address...

GHSA-GFQ8-HMPH-9GJV PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

Summary The PraisonAI Recipe HTTP server silently allows unauthenticated requests when auth is configured as api-key or jwt but the corresponding secret is missing. This creates an authentication fail-open condition. An operator can start the Recipe server with authentication enabled, including o...

CVE-2026-55533

PraisonAI is a multi-agent teams system. Prior to version 4.6.58 , the create_auth_middleware() function in the Recipe server exhibits a fail-open behavior: when auth=api-key is configured but the PRAISONAI_API_KEY environment variable is unset, or when JWT authentication is configured but PRAISO...

CVE-2026-55533 PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...

CVE-2026-55533 PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...

EUVD-2026-65523

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...

CVE-2026-55535 PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validatewebhookurl path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhookurl can later resolve to 127.0.0.1, 169.254.169.254, or another internal address...

GHSA-RG5Q-PP8P-F7JM PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summary praisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhook URLs by resolving the hostname and checking whether the IP is private. When DNS resolution fails socket.gaierror, the validator silently passes the URL via except socket.gaierror: pass. Additionally, even when...

CVE-2026-55537

PraisonAI , a multi-agent teams system, is affected by a webhook SSRF vulnerability via DNS fail-open in JobSubmitRequest.validate_webhook_url(). When DNS resolution raises socket.gaierror, the exception is silently swallowed (except socket.gaierror: pass), accepting the webhook_url. JobExecutor....

CVE-2026-55537 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validatewebhookurl accepts webhookurl when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor.sendwebhook later performs a fresh lookup, allowing DNS chang...

CVE-2026-55537 PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validatewebhookurl accepts webhookurl when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor.sendwebhook later performs a fresh lookup, allowing DNS chang...

EUVD-2026-65515

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validatewebhookurl accepts webhookurl when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor.sendwebhook later performs a fresh lookup, allowing DNS chang...

PT-2026-81326

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The Jobs API contains a flaw where the validate webhook url function fails open when a socket.gaierror occurs during DNS resolution. This allows the webhook url parameter to bypass validation if t...

github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...

github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

A flaw was found in kin-openapi. This vulnerability allows a remote attacker to bypass authentication checks. Specifically, the system incorrectly handles missing authentication configurations, substituting them with a function that does not verify user credentials. This enables unauthorized acce...

Server-side Request Forgery (SSRF)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the validatenetworkurl DNS resolution path in nltk/pathsec.py. An attacker can make urlopen reach restrict...