MervinPraison PraisonAI authentication bypass in recipe serve command

Executive brief

PraisonAI is an AI agent framework. A vulnerability in its command-line interface allows the 'recipe' server to be started on public network interfaces without any authentication, despite security settings intended to prevent this. This could allow unauthorized remote users to view, run, or modify AI workflows, potentially leading to data exposure or unauthorized use of AI model credits.

Technical details

A vulnerability exists in the Typer-based command-line entrypoint of PraisonAI where the 'recipe serve' command fails to enforce authentication when binding to non-localhost interfaces. While the legacy feature handler contains a guard to prevent this configuration, the primary Typer dispatcher routes requests to a deprecated implementation in 'src/praisonai/praisonai/cli/commands/recipe.py' that lacks this check. If a user starts the server with '--host 0.0.0.0', the application fails to attach API-key or JWT middleware unless explicitly provided via flags. An attacker can then access sensitive endpoints such as '/v1/recipes/run' and '/admin/reload' without credentials. This issue is patched in version 4.6.59.

Affected products

• MervinPraison praisonai >= 4.5.112, <= 4.6.58

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory
• 2026-06-18: patched: Fixed in version 4.6.59

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D