CVE-2026-55533: PraisonAI auth fail-open lets

CISO Take

PraisonAI's Recipe HTTP server has a fail-open authentication bug: when an operator explicitly configures `api-key` or `jwt` auth, the server silently drops back to no authentication if the corresponding secret was never set, and the CLI's non-localhost safety check only verifies auth mode isn't "none" without confirming a secret actually exists. That means an operator can believe they've locked down a server bound to 0.0.0.0 while it's actually wide open to unauthenticated recipe execution and, if admin endpoints are enabled, unauthenticated admin reload. No EPSS score or KEV listing exists yet since this is a freshly disclosed advisory (2026-08-25) with a working PoC but no public exploit or Nuclei template so far, though the blast radius is limited by only 1 tracked downstream dependent today. CISOs running PraisonAI Recipe servers should upgrade to 4.6.58 immediately, and in the interim audit every non-localhost deployment to confirm `PRAISONAI_API_KEY` or `PRAISONAI_JWT_SECRET` is actually set — a misconfiguration this silent will not show up in normal functional testing.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High severity (CVSS 8.2, AV:N/AC:L/PR:N/UI:N) despite no confidentiality/availability-only integrity impact profile mismatch aside — the real driver is trivial remote exploitability combined with the deceptive nature of the misconfiguration: operators who follow documented auth setup steps but omit or lose the secret environment variable get zero authentication with zero warning. No active exploitation (not in CISA KEV, no EPSS percentile, no public exploit, no Nuclei template), so this is a pre-exploitation disclosure. Exploitability requires no special skill (trivial) — an attacker just needs network access to the misconfigured host, no credentials, no user interaction. Exposure is currently limited by low ecosystem penetration (1 downstream dependent recorded) but the underlying package has a poor track record (153 other CVEs, package risk score 0/100), suggesting broader security hygiene concerns in the project.

How does the attack unfold?

Discovery

Attacker scans the internet or a target network for exposed PraisonAI Recipe servers bound to non-localhost interfaces.

AML.T0006

Exploitation

Attacker sends unauthenticated requests to recipe endpoints; the fail-open auth middleware allows the request through because no API key or JWT secret was configured.

AML.T0049

Agent tool invocation

Attacker triggers recipe execution or streaming endpoints, invoking whatever tools/workflows the agent recipes have access to.

AML.T0053

Impact

If admin endpoints are enabled, attacker also reaches `/admin/reload`, allowing unauthorized configuration changes or disruption of the running agent service.

Discovery

Attacker scans the internet or a target network for exposed PraisonAI Recipe servers bound to non-localhost interfaces.

AML.T0006

Exploitation

Attacker sends unauthenticated requests to recipe endpoints; the fail-open auth middleware allows the request through because no API key or JWT secret was configured.

AML.T0049

Agent tool invocation

Attacker triggers recipe execution or streaming endpoints, invoking whatever tools/workflows the agent recipes have access to.

AML.T0053

Impact

If admin endpoints are enabled, attacker also reaches `/admin/reload`, allowing unauthorized configuration changes or disruption of the running agent service.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	< 4.6.58	`4.6.58`
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

IHigh

ANone

What should I do?

1 step

Upgrade to PraisonAI >= 4.6.58 immediately, which fixes the fail-open middleware logic. Until patched, audit every non-localhost Recipe server deployment to verify PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET is actually present in the runtime environment — do not rely on the CLI's safety check, which only validates that auth mode is not "none". As a compensating control, front any externally-bound Recipe server with a network-level control (firewall allowlist, VPN, reverse-proxy auth) independent of the application's own auth layer, and disable enable_admin unless strictly required. Detection: review access logs for unauthenticated requests to /v1/recipes/run, /v1/recipes/stream, /v1/recipes/validate, or /admin/reload on hosts where auth is configured as api-key or jwt — presence of 200 responses without an X-API-Key or Authorization header on these paths indicates the fail-open condition was active.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionAgentAPIAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

GOVERN 1.5 / MAP 4.1-Risk monitoring and third-party AI component risk mapping

OWASP LLM Top 10

LLM06-Excessive Agency / Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-55533?

PraisonAI's Recipe HTTP server has a fail-open authentication bug: when an operator explicitly configures `api-key` or `jwt` auth, the server silently drops back to no authentication if the corresponding secret was never set, and the CLI's non-localhost safety check only verifies auth mode isn't "none" without confirming a secret actually exists. That means an operator can believe they've locked down a server bound to 0.0.0.0 while it's actually wide open to unauthenticated recipe execution and, if admin endpoints are enabled, unauthenticated admin reload. No EPSS score or KEV listing exists yet since this is a freshly disclosed advisory (2026-08-25) with a working PoC but no public exploit or Nuclei template so far, though the blast radius is limited by only 1 tracked downstream dependent today. CISOs running PraisonAI Recipe servers should upgrade to 4.6.58 immediately, and in the interim audit every non-localhost deployment to confirm `PRAISONAI_API_KEY` or `PRAISONAI_JWT_SECRET` is actually set — a misconfiguration this silent will not show up in normal functional testing.

Is CVE-2026-55533 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55533, increasing the risk of exploitation.

How to fix CVE-2026-55533?

Upgrade to PraisonAI >= 4.6.58 immediately, which fixes the fail-open middleware logic. Until patched, audit every non-localhost Recipe server deployment to verify `PRAISONAI_API_KEY` or `PRAISONAI_JWT_SECRET` is actually present in the runtime environment — do not rely on the CLI's safety check, which only validates that auth mode is not "none". As a compensating control, front any externally-bound Recipe server with a network-level control (firewall allowlist, VPN, reverse-proxy auth) independent of the application's own auth layer, and disable `enable_admin` unless strictly required. Detection: review access logs for unauthenticated requests to `/v1/recipes/run`, `/v1/recipes/stream`, `/v1/recipes/validate`, or `/admin/reload` on hosts where `auth` is configured as `api-key` or `jwt` — presence of 200 responses without an `X-API-Key` or `Authorization` header on these paths indicates the fail-open condition was active.

What systems are affected by CVE-2026-55533?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, workflow automation pipelines.

What is the CVSS score for CVE-2026-55533?

CVE-2026-55533 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.49%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servingworkflow automation pipelines

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 1.5 / MAP 4.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled. This issue is fixed in version 4.6.58.

Exploitation Scenario

An organization deploys a PraisonAI Recipe server on a cloud VM or Kubernetes pod, binding it to 0.0.0.0 so internal services can reach it, and sets `--auth api-key` believing this secures the endpoint. Due to a deployment error (e.g., the secret manager injection step fails silently, or `PRAISONAI_API_KEY` is only set in a different namespace), no actual key is configured. An external attacker who discovers the exposed port — via routine internet scanning or Shodan-style reconnaissance — sends unauthenticated requests directly to `/v1/recipes/run` and successfully triggers recipe execution without any credentials. If the operator also enabled the admin interface for convenience, the attacker further calls `/admin/reload` to manipulate server configuration, using the compromised agent workflow as a foothold for further internal reconnaissance or to pivot into whatever systems/tools the recipes have access to.

Weaknesses (CWE)

CWE-287Improper AuthenticationPrimary CWE-306Missing Authentication for Critical FunctionPrimary CWE-287Improper Authentication CWE-287Improper Authentication CWE-306Missing Authentication for Critical Functionality CWE-306Missing Authentication for Critical Functionality

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.