Executive brief
PraisonAI is a multi-agent AI orchestration platform that manages automated teams of AI agents. The platform exposes its job management API without authentication, allowing anyone with network access to submit arbitrary agent tasks, read sensitive job data, steal service credentials, and manipulate or delete other users' jobs. This creates a complete takeover risk for any organization running PraisonAI without external authentication controls.
Technical details
The vulnerability is an authentication bypass in the praisonai.jobs.server.create_app function, which mounts the job management router (praisonai.jobs.router.create_router) at /api/v1/runs without any authentication or authorization checks. A network-accessible attacker can call these endpoints to submit attacker-controlled prompts and agent configurations, enumerate and read job details and results, stream job output, and cancel or delete other jobs. The attack requires only network reachability to the API endpoint; no credentials or user interaction are required. This exposes service credentials configured in agents and the capabilities of connected tools to arbitrary execution. The vulnerability is fixed in version 4.6.58 by adding input validation, query parameterization, and authentication controls.
Affected products
- Mervin Praison PraisonAI prior to 4.6.58
Timeline
- 2026-09-14: disclosed
- 2026-06-13: patched: Version 4.6.58 released with authentication and input validation hardening