Executive brief
PraisonAI is a multi-agent system that allows teams to define and invoke AI agents through an API. When the PRAISONAI_CALL_AUTH setting is disabled (advertised as a supported opt-out), the authentication verification fails to enforce the required CALL_SERVER_TOKEN, allowing unauthenticated attackers to invoke registered agents and access their connected tools and private context data.
Technical details
The vulnerability is an authentication bypass in the verify_token function that validates API requests to /api/v1/agents/{id}/invoke. When PRAISONAI_CALL_AUTH is set to disabled, the token validation logic incorrectly accepts unauthenticated requests without enforcing the CALL_SERVER_TOKEN requirement. An attacker with network access to the API endpoint can invoke any registered agent without credentials, gaining access to agent-connected tools and private context data. The vulnerability affects all versions prior to 4.6.62 and is fixed in the patched release.
Affected products
- Mervin Praison PraisonAI prior to 4.6.62
Timeline
- 2026-09-14: disclosed
- 2026-06-17: patched: Version 4.6.62 released