Description

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET and the corresponding recipe value are absent. Unauthenticated clients can then reach recipe execution, input, and output surfaces and may trigger connected tools despite the operator explicitly enabling authentication. This issue is fixed in 4.6.58.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T16:17:13.557Z",
  "pubdate": "2026-09-14T16:17:13.557Z",
  "executiveSummary": "PraisonAI versions prior to 4.6.58 contain an authentication bypass vulnerability involving the APIKeyAuthMiddleware and JWTAuthMiddleware components.\nThe vulnerability occurs because these middleware layers fail to enforce authentication when the environment variables PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET are unset, effectively defaulting to an unauthenticated state despite an operator choosing to enable these security layers.\nThis flaw allows unauthenticated remote attackers to interact with recipe execution, input, and output surfaces.\nThe impact is significant, as an attacker can bypass intended access controls to execute sensitive tools or manipulate data within the multi-agent system.\nExploitation requires no credentials, as the middleware logic erroneously permits request forwarding when the configured secret values are absent or improperly initialized.\nThe risk is critical for any deployment relying on api-key or JWT authentication for securing API access or workflow execution.\nUsers must upgrade to version 4.6.58 or later to remediate the flaw.",
  "technicalDetails": "The root cause of this vulnerability lies in the conditional logic within the APIKeyAuthMiddleware and JWTAuthMiddleware implementations in PraisonAI. Specifically, the middleware components are designed to intercept and validate requests based on the selected authentication scheme (api-key or JWT).\nHowever, the implementation contains a logic error where the middleware implicitly forwards requests to the application core if the corresponding secret configuration variables (PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET) are not explicitly set in the environment. Instead of defaulting to a 'deny-all' state when authentication is enabled but secrets are missing, the middleware bypasses the validation check entirely.\nThis creates an authentication bypass condition. When an operator attempts to secure the system by selecting these methods, the middleware essentially becomes a pass-through proxy for any incoming HTTP request. An attacker can probe the recipe execution surfaces, provide arbitrary inputs, and retrieve outputs without presenting a valid API key or a correctly signed JWT token.\nThe attack flow proceeds as follows: 1) The attacker targets the public-facing API endpoints associated with recipe execution. 2) The request reaches the middleware layer. 3) The middleware checks for the presence of the environment-defined secrets. 4) Due to the vulnerability, the middleware detects the absence of these variables and skips the authentication enforcement step, returning control to the application handler.\nThis enables an unauthenticated actor to trigger connected tools defined in the PraisonAI workflow. Because the application logic proceeds as if the request were authorized, the underlying agents execute actions with the privileges of the system itself, potentially leading to unauthorized data exfiltration, tool execution, or system compromise depending on the agents' configured capabilities.\nThe vulnerability affects all versions of PraisonAI prior to 4.6.58. It is highly exploitable via network-based access to the service interface, as it does not require a valid user account or knowledge of system secrets, provided those secrets remain unset in the host environment. Impact includes unauthorized access to the multi-agent orchestration layer and potential manipulation of business-critical workflows."
}