Description

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.6.62.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-14T16:17:14.860Z",
  "pubdate": "2026-09-14T16:17:14.860Z",
  "executiveSummary": "PraisonAI versions prior to 4.6.62 contain an authentication bypass vulnerability involving the 'PRAISONAI_CALL_AUTH' configuration flag.\nThe vulnerability allows unauthenticated remote actors to trigger the '/api/v1/agents/{id}/invoke' endpoint by setting the environment variable 'PRAISONAI_CALL_AUTH' to 'disabled'.\nThis flaw effectively disables the mandatory 'CALL_SERVER_TOKEN' validation, granting unauthorized access to sensitive agent invocation functions.\nImpact includes the unauthorized execution of registered agents, potentially leading to the exposure of connected tools, sensitive data, and internal context.\nThe risk is critical for deployments where this security opt-out is enabled, as it removes the primary barrier against malicious API interactions.\nNo complex exploitation is required; an attacker simply needs network access to the API endpoint to perform actions as the configured agents.",
  "technicalDetails": "The vulnerability resides in the application's authentication logic, specifically within the 'verify_token' function responsible for validating the 'CALL_SERVER_TOKEN' header during API requests.\nIn versions prior to 4.6.62, the application checks the 'PRAISONAI_CALL_AUTH' environment variable. If set to 'disabled', the 'verify_token' function logic short-circuits the standard authentication flow, permitting the request to proceed without verifying the presence or validity of the authentication token.\nThe target endpoint, '/api/v1/agents/{id}/invoke', is inherently designed to execute agent-based tasks. By bypassing the 'verify_token' check, an unauthenticated attacker can craft a malicious HTTP request to this endpoint to invoke any registered agent by its unique identifier.\nExploitation involves the following sequence: 1) The attacker identifies a target PraisonAI deployment where 'PRAISONAI_CALL_AUTH' is configured as 'disabled'. 2) The attacker crafts an HTTP request to '/api/v1/agents/{id}/invoke' targeting a specific agent ID. 3) The 'verify_token' function inspects the configuration, determines that authentication is explicitly disabled, and returns a successful validation status despite the lack of any 'CALL_SERVER_TOKEN'. 4) The application processes the invocation request, executing the agent's logic.\nThe post-exploitation impact is severe, as agents often have access to external tools, private data contexts, and internal service credentials. An attacker can leverage this bypass to perform unauthorized data exfiltration, command execution, or manipulation of third-party systems integrated with the PraisonAI agent framework.\nThe vulnerable code path effectively invalidates the security posture of the entire agent invocation subsystem, shifting the responsibility of access control entirely to environmental configuration, which, if mismanaged, leads to a total compromise of the agent execution layer."
}