🛡️ CVE-2026-57131 — praisonai

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

# praisonai: Jobs API exposes agent-execution endpoints with no authentication

Researcher: Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research

Target: https://github.com/MervinPraison/PraisonAI

Package: praisonai on PyPI

Affected version (empirically tested): 4.6.48

Components:

• praisonai.jobs.server.create_app — praisonai/jobs/server.py
• praisonai.jobs.router.create_router — praisonai/jobs/router.py
• Routes mounted at /api/v1/runs/...

Weakness: CWE-306 Missing Authentication for Critical Function · CWE-862 Missing Authorization · CWE-94 Code Injection (via prompt / agent_yaml).

TL;DR

praisonai ships a standalone async-jobs HTTP server (python -m praisonai.jobs.server --host=0.0.0.0 --port=8005) whose job is to accept job submissions and run agents on the operator's behalf. Every endpoint under /api/v1/runs is unauthenticated. There is no auth_token field, no Depends(verify_*), no middleware that inspects Authorization — the CORS middleware *lists* Authorization in allow_headers (the only signal in the whole module that the developer was aware authentication is a thing), but no route ever reads it.

A network-reachable attacker can:

1. Execute arbitrary agent code — POST /api/v1/runs accepts prompt, agent_yaml, agent_file, config, framework. The job is queued and an executor invokes whichever framework (praisonai / crewai / autogen) the attacker picks, with whichever prompt and tool config the attacker supplies. The job runs in the operator's process — same environment variables, same filesystem, same credentials (OpenAI / Anthropic / Azure / Bedrock keys; tool integrations; on-disk YAML recipes).

2. List and read every job system-wide — GET /api/v1/runs lists all jobs; GET /api/v1/runs/{job_id}/result returns the full result of any completed job. Operator's prompts, the agent's chain-of-thought, tool inputs / outputs, retrieved documents — all readable to an anonymous client.

3. Cancel or delete any job — POST /…/cancel and DELETE /…/{job_id} accept arbitrary job IDs without any ownership / authorization check.

4. Stream live SSE of any in-flight job — GET /…/{job_id}/stream reads the executor's live progress for any job ID.

The remote-RCE shape (1) is the load-bearing one. Even with webhook_url SSRF-guarded (and it is — the model validator at jobs/models.py:42-65 rejects localhost / private IPs), the attacker needs no callback: SSE streaming returns the agent's output directly on the same connection.

Root cause

```

Expected behavior when starting praisonai.jobs.server:

"I'm running an HTTP API my application backend will call.

The CORS middleware permits Authorization, so the server

enforces it. Anonymous attackers cannot submit jobs."

Actual behavior (praisonai 4.6.48):

• server.py:59-152 create_app builds a FastAPI app, adds

CORSMiddleware, includes the jobs router.

NO auth middleware. NO global Depends.

• router.py:43 @router.post("") submit_job(...)

No Depends, no Authorization header read,

no auth_token config field at all.

• router.py:109,148,161,180,205,224 every other route:

likewise, no auth on any of GET-list,

GET-status, GET-result, POST-cancel,

DELETE, GET-stream.

• server.py:117 CORS allow_headers DOES include

"Authorization" — the only token in the

entire jobs/ subpackage that suggests

the developer was thinking about auth.

Impact:

The API is intended to be production-ready (the CORS code at

server.py:96-102 explicitly branches on

os.getenv("ENVIRONMENT") == "production" to harden origins),

yet ships with no authentication layer at all. Operators who

bind the server to a network interface — including the

suggested --host=0.0.0.0 in the CLI parser — expose

unauthenticated agent execution to anyone who can reach the

port.

```

The same package gets auth right elsewhere (praisonai/gateway/server.py auto-generates an auth_token if none is configured and refuses to serve requests without it; praisonai/endpoints/a2u_server.py:250-264 uses hmac.compare_digest on a Bearer token). The jobs API is the outlier.

Empirically affected routes

Verified by PoC against published praisonai==4.6.48 (/api/v1/runs/... paths):

| Method | Path | Unauth result |

|----------|-------------------------------|--------------------------|

| POST | /api/v1/runs | HTTP 202 Accepted, attacker job queued and executor invoked the framework |

| GET | /api/v1/runs