PraisonAI Jobs API missing authentication in agent-execution endpoints

Executive brief

PraisonAI, a framework for managing AI agents, contains a vulnerability in its Jobs API server where critical endpoints are completely unauthenticated. This allows any individual with network access to the server to execute arbitrary AI agent code, which can lead to full system compromise, the theft of sensitive API keys (like OpenAI or Anthropic), and the exposure of private data from previous jobs. An attacker could also delete or cancel active jobs, causing a complete disruption of service.

Technical details

The `praisonai.jobs.server` component implements a FastAPI-based HTTP API that lacks authentication middleware or dependency injection for authorization. Specifically, routes under `/api/v1/runs` (including POST for job submission and GET for job results) do not validate credentials, despite the CORS configuration suggesting an expectation of an 'Authorization' header. An attacker can submit jobs with malicious prompts or YAML configurations to achieve Remote Code Execution (RCE) within the context of the server process, access environment variables (API keys), and read or delete any job data stored in the `InMemoryJobStore`. The vulnerability is present in version 4.6.48 and was addressed in version 4.6.59.

Affected products

• MervinPraison praisonai < 4.6.59

Timeline

• 2026-06-17: advisory: GHSA-fq2m-6wqh-x44g published
• 2026-06-17: patched: Fixed in version 4.6.59

References

• https://api.github.com/users/SnailSploit
• https://github.com/SnailSploit
• https://api.github.com/users/SnailSploit/gists%7B/gist_id%7D
• https://api.github.com/users/SnailSploit/repos
• https://avatars.githubusercontent.com/u/95986478?v=4
• https://api.github.com/users/SnailSploit/events%7B/privacy%7D