Authentication Bypass in PraisonAI Affecting Multi-Agent Teams System
CVE-2026-57127
9.8CRITICAL
What is CVE-2026-57127?
PraisonAI, a multi-agent teams system, had a critical vulnerability prior to version 4.6.58 that allows unauthenticated clients to bypass the intended authentication methods when API key or JWT authentication was enabled. This occurs because the system fails to properly validate the presence of necessary authentication tokens (PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET) before granting access to sensitive recipe execution and output surfaces. This oversight allows malicious actors to potentially interact with connected tools despite the operator's configuration of security measures. Users are highly recommended to upgrade to version 4.6.58 to mitigate this risk.
Affected Version(s)
PraisonAI < 4.6.48