Is CVE-2026-57134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57134 being exploited in the wild.

How severe is CVE-2026-57134?

High severity, with a CVSS score of 8.2, published 15 September 2026.

Which products and versions are affected?

praisonai (npm) SEMVER:introduced=1.5.1,fixed=1.7.2.

Is there a fix for CVE-2026-57134?

Yes. praisonai (npm): upgrade to 1.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57134 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57134?

Check whether you run praisonai (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57134: npm PraisonAI MCPSecurity auth bypass in Basic/OAuth validation

CVE-2026-57134 · Severity: high · CVSS 8.2 · Published 2026-09-15

PraisonAI's MCPSecurity library is used to protect MCP (Model Context Protocol) servers by enforcing authentication policies. The library advertises support for Basic and OAuth authentication methods but fails to validate credentials for these methods, accepting any non-empty Authorization header as valid. This allows attackers to bypass authentication protections and access protected MCP tools, resources, and trigger agent actions without valid credentials.

Technologies: praisonai (npm). Vendors: npm.

Quick answers

Is CVE-2026-57134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57134 being exploited in the wild.
How severe is CVE-2026-57134?: High severity, with a CVSS score of 8.2, published 15 September 2026.
Which products and versions are affected?: praisonai (npm) SEMVER:introduced=1.5.1,fixed=1.7.2.
Is there a fix for CVE-2026-57134?: Yes. praisonai (npm): upgrade to 1.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57134 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57134?: Check whether you run praisonai (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonai (npm): upgrade to 1.7.2 or later
```
npm install praisonai@1.7.2
```

Technical details

The vulnerability is an authentication bypass in the evaluatePolicy() function of MCPSecurity's authentication evaluator. The vulnerability class is CWE-287 (Improper Authentication) / CWE-288 (Authentication Bypass Using an Alternate Path). The library's evaluatePolicy() method only calls the configured validate() callback for 'api-key' and 'bearer' authentication methods. For 'basic' and 'oauth' methods, after extracting a non-empty token from the Authorization header, the code falls through to a success return without invoking the validator, accepting any request with a non-empty Authorization header as authenticated. The attack vector is network-based with no authentication or user interaction required. An attacker can send an HTTP request with any non-empty Basic or OAuth Authorization header to bypass authentication and access protected MCP resources, call protected tools, or trigger agent workflows. Patch: Fixed in npm praisonai version 1.7.2 and later.

Affected products

npm praisonai >=1.5.1, <=1.7.1

Identifiers

CVE-2026-57134
GHSA-4qq2-2j2x-x62c

Timeline

2026-06-18: disclosed: Advisory GHSA-4qq2-2j2x-x62c published on GitHub
2026-06-18: patched: Fixed in npm praisonai version 1.7.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.