Is CVE-2026-57132 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57132 being exploited in the wild.

How severe is CVE-2026-57132?

High severity, with a CVSS score of 8.2, published 14 September 2026.

Which products and versions are affected?

praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.61.

Is there a fix for CVE-2026-57132?

Yes. praisonai (PyPI): upgrade to 4.6.61 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57132 attacked?

It is attacked over the network.

Am I affected by CVE-2026-57132?

Check whether you run praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57132: PraisonAI authentication bypass with PRAISONAI_CALL_AUTH disabled

CVE-2026-57132 · Severity: high · CVSS 8.2 · Published 2026-09-14

PraisonAI is a multi-agent system that allows teams to define and invoke AI agents through an API. When the PRAISONAI_CALL_AUTH setting is disabled (advertised as a supported opt-out), the authentication verification fails to enforce the required CALL_SERVER_TOKEN, allowing unauthenticated attackers to invoke registered agents and access their connected tools and private context data.

Technologies: praisonai (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-57132 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57132 being exploited in the wild.
How severe is CVE-2026-57132?: High severity, with a CVSS score of 8.2, published 14 September 2026.
Which products and versions are affected?: praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.61.
Is there a fix for CVE-2026-57132?: Yes. praisonai (PyPI): upgrade to 4.6.61 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57132 attacked?: It is attacked over the network.
Am I affected by CVE-2026-57132?: Check whether you run praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonai (PyPI): upgrade to 4.6.61 or later
```
pip install "praisonai>=4.6.61"
```

Technical details

The vulnerability is an authentication bypass in the verify_token function that validates API requests to /api/v1/agents/{id}/invoke. When PRAISONAI_CALL_AUTH is set to disabled, the token validation logic incorrectly accepts unauthenticated requests without enforcing the CALL_SERVER_TOKEN requirement. An attacker with network access to the API endpoint can invoke any registered agent without credentials, gaining access to agent-connected tools and private context data. The vulnerability affects all versions prior to 4.6.62 and is fixed in the patched release.

Affected products

Mervin Praison PraisonAI prior to 4.6.62

Identifiers

CVE-2026-57132
GHSA-8ccj-p46r-jwqq
PYSEC-2026-3508

Timeline

2026-09-14: disclosed
2026-06-17: patched: Version 4.6.62 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.