MervinPraison PraisonAI authentication bypass in recipe serve middleware

Executive brief

PraisonAI is a framework for running AI agent workflows. A security flaw in its 'recipe serve' component allows the authentication system to silently disable itself if a secret key is not explicitly provided in the configuration. This means that even if an administrator intends to secure the system with an API key or token, the system may remain completely open to the internet without warning, allowing unauthorized users to execute arbitrary AI tasks, access sensitive data, or potentially gain control over the underlying server.

Technical details

The `APIKeyAuthMiddleware` and `JWTAuthMiddleware` in `praisonai/recipe/serve.py` contain a logic error where the `dispatch` method returns `call_next(request)` if the expected secret (API key or JWT secret) is not found in the configuration or environment variables. This 'fail-open' behavior occurs even when the user has explicitly enabled authentication in the recipe YAML (e.g., `auth: api-key`). An attacker can reach the `/runs` endpoint without any credentials to trigger arbitrary recipe executions, read LLM inputs/outputs, or achieve remote code execution if the environment is configured with tools like browser automation or filesystem access. The vulnerability is present in version 4.6.48 and was addressed in version 4.6.59.

Affected products

• MervinPraison praisonai <= 4.6.48

Timeline

• 2026-06-17: advisory: GitHub Advisory GHSA-j4hj-7hfh-g2f4 published
• 2026-06-18: disclosed

References

• https://api.github.com/users/SnailSploit
• https://github.com/SnailSploit
• https://api.github.com/users/SnailSploit/gists%7B/gist_id%7D
• https://api.github.com/users/SnailSploit/repos
• https://avatars.githubusercontent.com/u/95986478?v=4
• https://api.github.com/users/SnailSploit/events%7B/privacy%7D