Executive brief
PraisonAI's Recipe server is an HTTP service that allows users to execute automated workflows and recipes. When an operator configures the server to require API key or JWT authentication but fails to provide the actual secret value, the server silently accepts all unauthenticated requests, effectively bypassing security controls. An attacker can remotely trigger recipe execution workflows, perform administrative operations, or access sensitive functionality without any credentials.
Technical details
The vulnerability is a fail-open authentication bypass in PraisonAI's Recipe HTTP server. In the `create_auth_middleware()` function (src/praisonai/praisonai/recipe/serve.py), both API key and JWT authentication middleware check whether a secret is configured and silently allow the request to proceed if no secret is present. The API key middleware resolves the expected key from either a parameter or the `PRAISONAI_API_KEY` environment variable, and if neither is set, it calls `await call_next(request)` without validating the request. The JWT middleware exhibits identical fail-open behavior with the `PRAISONAI_JWT_SECRET` variable. An additional weakness exists in the CLI safety check (src/praisonai/praisonai/cli/features/recipe.py) which validates that `auth != "none"` for non-localhost bindings but does not verify that the corresponding secret is actually configured, allowing the command `praisonai recipe serve --host 0.0.0.0 --auth api-key` to pass validation even with a missing key. Attack vector is network-based with no authentication required. An attacker can invoke protected endpoints including `POST /v1/recipes/run`, `POST /v1/recipes/stream`, and `POST /admin/reload`. The fix shipped in version 4.6.58.
Affected products
- MervinPraison PraisonAI < 4.6.58
Timeline
- 2026-08-25: disclosed: Advisory published to GitHub Security Advisory Database
- 2026-06-13: patched: Fix released in version 4.6.58