Unauthenticated API Access in PraisonAI Multi-Agent System

CVE-2026-55539

What is CVE-2026-55539?

The PraisonAI multi-agent teams system contains a security flaw in its Jobs API, specifically in the create_app function. Prior to version 4.6.51, the API endpoint '/api/v1/runs' could be accessed without any authentication. This loophole permits unauthorized users to submit jobs, read results, cancel jobs, or delete entries using operator credentials. The vulnerability has been addressed by incorporating an authentication mechanism via PRAISONAI_JOBS_API_KEY middleware, which now requires an Authorization token or X-API-Key for access. Users are urged to upgrade to version 4.6.58 or later to mitigate this risk.

References