Executive brief
PraisonAI is a multi-agent AI system that can be deployed with API authentication enabled to protect sensitive recipe execution endpoints. A flaw in the authentication middleware allows unauthenticated clients to bypass these security controls when environment variables are not configured, directly accessing recipe execution, input/output surfaces, and triggering connected AI tools despite the operator explicitly enabling authentication. This could allow unauthorized parties to manipulate AI workflows and access sensitive data.
Technical details
The vulnerability is an authentication bypass in PraisonAI's recipe serve component. When an operator selects API-key or JWT authentication, the APIKeyAuthMiddleware or JWTAuthMiddleware is installed but contains a logic flaw: it forwards requests when the corresponding environment variables (PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET) or recipe configuration values are absent, rather than rejecting them. This allows unauthenticated clients to reach protected recipe execution, input, and output endpoints and trigger connected tools. The attack requires network access to the recipe serve endpoint but no authentication credentials. The vulnerability was fixed in version 4.6.58 with hardened input validation and improved middleware logic.
Affected products
- PraisonAI PraisonAI before 4.6.58
Timeline
- 2026-09-14: disclosed
- 2026-06-13: patched: Version 4.6.58 released with fix