PraisonAI - Authentication Bypass

PraisonAI 2.5.6 to 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server. id: CVE-2026-44338 info: name: PraisonAI -...

CVE-2026-44338-Lab

CVE-2026-44338 PraisonAI 認証バイパスラボ CVE-2026-44338 のローカル Docker ラボ。PraisonAI のレガシー Flask API サーバーにおける認証バイパスです。 このラボは、レガシー API ルートにおける未認証アクセス状態を実証します。完全な PraisonAI デプロイメントではなく、安全なルートレベルの再現を意図的に使用しているため、証明は認証の欠陥に焦点を当て、実際のエージェントワークフローや外部 LLM 呼び出しをトリガーしません。 概要 CVE-2026-44338 は PraisonAI バージョン = 2.5.6 お...

CVE-2026-55529

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:53+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wj6g-v78p-6fx3...

CVE-2026-55526

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:46+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x44h-65qv-cw74...

CVE-2026-55534

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:44+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7ww9-85pg-cv4x...

CVE-2026-55540

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:37+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8 2026-08-25 18:13:47+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtwgc6uuyp2g 2026-08-25...

CVE-2026-55527

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:24+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gxmw-5f7x-6g22...

CVE-2026-55539

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:21+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2jgc-f764-c5r2...

CVE-2026-55536

creationtimestamp| type| source ---|---|--- 2026-08-25 16:35:14+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g6r-q6gw-w8fg 2026-08-25 18:08:14+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtwfybfgai2b 2026-08-25...

CVE-2026-55539

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...

CVE-2026-55536

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

CVE-2026-55532

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

CVE-2026-55533

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...

GHSA-6G6R-Q6GW-W8FG PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...

CVE-2026-55536

PraisonAI , a multi-agent teams system, contains a patch bypass (of CVE-2026-40289) in its Browser Server _handle_connection() method. The origin validation uses re.match() with the unanchored pattern chrome-extension://[a-z0-9]{32}, so extra trailing characters are ignored, allowing an attacker ...

CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

GHSA-PVPH-5J39-V8QC PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server

Summary The PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...

EUVD-2026-65544

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...