PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server runningthe PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains twoweaknesses: the /api/v1/runs endpoint...

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server runningthe PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains twoweaknesses: the /api/v1/runs endpoint...

praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonai: recipe serve authentication middleware silently disables itself when no secret is setResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAI---Package: praisonai on PyPIVersion tested: 4.6.48.File:...

PYSEC-2026-3529 PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...

PYSEC-2026-3520 PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI recipe.runstream skips dangerous-tool policy enforcement Summary PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allowdangeroustools=True. The normal recipe.run path enforces this with checktoolpolicy. The streaming path,...

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

PraisonAI recipe.runstream skips dangerous-tool policy enforcement SummaryPraisonAI recipe execution blocks default-denied dangerous tools unless thecaller explicitly passes allowdangeroustools=True. The normal recipe.runpath enforces this with checktoolpolicy. The streaming path,recipe.runstream...

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard SummaryPraisonAI's installed console entrypoint is Typer-first. In current releases,the recipe command is registered in the Typer app andpraisonai recipe serve dispatches to the deprecated Typer command...

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI LinearBot processes unsigned webhooks when LINEARWEBHOOKSECRET is missing SummaryPraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treatsLINEARWEBHOOKSECRET as optional. When the secret is absent, startup only logsa warning and handlewebhook skips Linear-Signature...

PYSEC-2026-3522 PraisonAI: Compute-bridged file tools allow shell command injection

Compute-bridged file tools allow shell command injection Summary LocalManagedAgent / SandboxedAgent compute bridging wraps readfile, listfiles, and writefile when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then...

PYSEC-2026-3502 PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard Summary PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...

PYSEC-2026-3510 PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI LinearBot processes unsigned webhooks when LINEARWEBHOOKSECRET is missing Summary PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEARWEBHOOKSECRET as optional. When the secret is absent, startup only logs a warning and handlewebhook skips Linear-Signature...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, text-generation-inference, openstack-keystone-2026.1, superset, openstack-placement-2026.1, airflow, superset-fips, ansible-operator-fips, pypy-3.10, datahub-ingestion, mlflow, authentik-fips, openstack-keystone-2025.2-fips,...

GHSA-H35F-9H28-MQ5C vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1-fips, text-generation-inference, openstack-keystone-2026.1, superset, openstack-placement-2026.1, airflow, superset-fips, ansible-operator-fips, pypy-3.10, datahub-ingestion, mlflow, authentik-fips, openstack-keystone-2025.2-fips,...

GHSA-GG3M-VVP2-P2C5 vulnerabilities

Vulnerabilities for packages: flux, crossplane-provider-aws-fis, flux-source-controller-fips, nginx-kubernetes-ingress-fips, bento-fips, hubble, amazon-cloudwatch-agent-operator, flux-image-reflector-controller, docker-cli-fips, grype-fips, spicedb-operator, newrelic-k8s-metrics-adapter-fips,...

CVE-2026-46600 vulnerabilities

Vulnerabilities for packages: flux, crossplane-provider-aws-fis, flux-source-controller-fips, nginx-kubernetes-ingress-fips, bento-fips, hubble, amazon-cloudwatch-agent-operator, flux-image-reflector-controller, docker-cli-fips, grype-fips, spicedb-operator, newrelic-k8s-metrics-adapter-fips,...

CVE-2026-62290 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, percona-server-mongodb-operator, aws-privateca-issuer, cert-manager-cmctl, step-issuer, mariadb-operator, cert-manager-istio-csr, cert-manager-csi-driver...

PT-2026-64137

PraisonAI AgentTeam.launch exposes unauthenticated remote agent invocation endpoints Summary PraisonAI's documented Python AgentTeam.launch / Agents.launch HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement. The current implementation registe...

RHEL 8 : compat-openssl10 (RHSA-2026:44480)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:44480 advisory. The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries and is...

RHEL 9 : dovecot (RHSA-2026:44373)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:44373 advisory. Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and...

PT-2026-64126

praisonai-platform: default JWT signing secret dev-secret-change-me Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai-platform on PyPI Latest version and version tested: 0.1.4,...