Unauthenticated Access Vulnerability in PraisonAI Multi-Agent System
CVE-2026-56836

8.2HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
23 October 2026

What is CVE-2026-56836?

PraisonAI, a multi-agent teams system, has a vulnerability that allows unauthenticated users to access its Recipe API. Versions prior to 4.6.59 expose a deprecated Typer command, which launches an HTTP server without proper authentication. This setup enables unauthorized requests to reach sensitive endpoints, potentially compromising the application's integrity. The issue has been addressed in the latest secure version.

Affected Version(s)

PraisonAI >= 4.5.112, < 4.6.59

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.