Description

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. This vulnerability is fixed in 4.6.58.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T16:17:14.710Z",
  "pubdate": "2026-09-14T16:17:14.710Z",
  "executiveSummary": "The PraisonAI multi-agent system contains a critical authentication bypass vulnerability in versions prior to 4.6.58.\nThe vulnerability originates from the improper exposure of the /api/v1/runs endpoint, which lacks necessary authentication and granular authorization controls.\nThis flaw enables unauthenticated network actors to interact directly with the jobs API, allowing them to manipulate agent workflows, execute arbitrary prompts, and access sensitive service configurations.\nThe impact is severe, as it grants unauthorized users the ability to list, read, stream, cancel, and delete jobs, effectively leading to full administrative control over the agent execution environment.\nBy leveraging this access, an attacker can exfiltrate credentials, hijack tool capabilities connected to the platform, and perform remote code execution via attacker-supplied agent prompts.\nExploitation does not require prior knowledge of legitimate session tokens, as the router fails to enforce identity verification for the impacted routes.",
  "technicalDetails": "The root cause of this vulnerability is the insecure mounting of the praisonai.jobs.router.create_router within the praisonai.jobs.server.create_app component.\nThe application architecture exposes a comprehensive suite of API operations under the /api/v1/runs path without wrapping the router in any authentication or authorization middleware.\nIn affected versions (pre-4.6.58), any request sent to the exposed /api/v1/runs endpoint is processed by the backend logic without validating the requester's identity or permissions.\nThe attack flow begins when an unauthenticated network client sends HTTP requests directly to the exposed endpoints. Since no authorization checks occur, the server treats these requests as valid, privileged operations.\nAttackers can leverage this to submit malicious agent configurations and arbitrary prompts. Because the system is designed for multi-agent orchestration, the server executes these payloads using the service's configured privileges and connected toolsets.\nFurthermore, the lack of per-job authorization means that a single attacker can traverse, view, and terminate jobs belonging to other users or system processes. This leads to a total loss of confidentiality regarding job data and a denial-of-service capability against legitimate agent workflows.\nThe vulnerability allows the attacker to intercept sensitive service credentials—which may be environment-specific or project-wide—and utilize integrated external tools. By crafting specific prompts, an attacker can manipulate the agent's behavior to interact with private APIs or internal systems that the PraisonAI instance is permitted to access.\nThe exploit process is trivial, requiring only network reachability to the API server. By interacting with the defined routes in praisonai.jobs.router, an attacker can exhaust system resources, delete active runs to disrupt business operations, or perform lateral movement through unauthorized tool usage."
}