Executive brief
PraisonAI's Jobs API endpoint (`/api/v1/runs`) is used to submit and manage background jobs that execute against an operator's configured LLM credentials. The API completely lacks authentication controls, allowing any caller who can reach the service to submit arbitrary jobs (incurring LLM costs), enumerate all queued jobs, read other users' results, cancel running jobs, and delete completed jobs. In the default configuration, the service only listens on localhost, but if exposed via reverse proxy, container publishing, or misconfiguration, an attacker gains full control of the job queue.
Technical details
The vulnerability is a missing authentication control in the FastAPI jobs router. The `create_app()` function in `praisonai/jobs/server.py` instantiates a FastAPI application and includes the jobs router with only CORS middleware—no authentication middleware, no router-level `Depends()` dependency, and no per-route auth checks. Each endpoint (`POST /api/v1/runs` to submit, `GET /api/v1/runs` to list, `GET /api/v1/runs/{id}/result` to read output, `POST /api/v1/runs/{id}/cancel` to interrupt, `DELETE /api/v1/runs/{id}` to delete) accepts requests without validating credentials. The `submit_job()` handler accepts attacker-supplied JSON, builds a Job object, and invokes the executor which runs the prompt against a real AI agent using the operator's configured LLM keys. The in-memory store has no owner/principal concept, so `list_jobs()` returns all jobs visible to any caller. The vulnerability requires network reachability (the default bind is `127.0.0.1`, but it can be exposed via reverse proxy, container publishing, or operator misconfiguration with `--host 0.0.0.0`). Once reachable, the attack is fully pre-authenticated. This is a distinct sibling of CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj), which patched only the legacy Flask API server but did not touch the FastAPI jobs module.
Affected products
- MervinPraison PraisonAI < 4.6.58
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in version 4.6.58