CVE-2026-56836: PraisonAI: unauthenticated recipe server exposes admin

HIGH

Published October 23, 2026

CISO Take

PraisonAI versions 4.5.112 through 4.6.58 let the deprecated `praisonai recipe serve` Typer command start the Recipe HTTP server on a non-localhost interface with no authentication, so anyone who can reach the port can call the recipe API and, when enabled, /admin/reload. The CVSS of 8.2 reflects network reachability, no privileges and no user interaction, with high integrity impact. No public exploit, Nuclei template, KEV listing or EPSS score exists yet, and the package has only 1 downstream dependent. However, it has 187 other tracked CVEs, which points to a weak security track record, and the flaw is a trivial misconfiguration-class bug. Upgrade to 4.6.59 immediately, and until then, bind recipe servers to localhost, put them behind an authenticating reverse proxy, or block access at the network layer. Also inventory any hosts running `praisonai recipe serve` to confirm none are exposed.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High. Exploitation needs only network access to the recipe server port, with no credentials or user interaction (AV:N/AC:L/PR:N/UI:N). Impact is mainly integrity (I:H) because unauthenticated callers can invoke recipes and reload configuration through /admin/reload, with limited confidentiality impact (C:L). Exposure is limited to deployments that launched the server via the Typer command on a non-loopback interface, which lowers the real-world population. There is no known active exploitation, public exploit, scanner template or KEV listing, and EPSS is unavailable. Risk rises sharply for internet-facing or shared-network deployments where recipes can trigger agent actions or tool use.

How does the attack unfold?

Discovery

Attacker scans for hosts exposing the PraisonAI recipe server port on a non-localhost interface.

AML.T0006

Initial Access

Attacker sends requests to the recipe API, which has no API-key or JWT middleware attached.

AML.T0049

Exploitation

Attacker invokes recipes to drive agents and tools, and calls /admin/reload where enabled to change configuration.

AML.T0053

Impact

Unauthorized workflow execution, configuration tampering, and misuse of LLM credentials and agent tool access.

AML.T0048

Discovery

Attacker scans for hosts exposing the PraisonAI recipe server port on a non-localhost interface.

AML.T0006

Initial Access

Attacker sends requests to the recipe API, which has no API-key or JWT middleware attached.

AML.T0049

Exploitation

Attacker invokes recipes to drive agents and tools, and calls /admin/reload where enabled to change configuration.

AML.T0053

Impact

Unauthorized workflow execution, configuration tampering, and misuse of LLM credentials and agent tool access.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

IHigh

ANone

What should I do?

1 step

1) Upgrade PraisonAI to 4.6.59 or later. 2) Until patched, run the recipe server only on 127.0.0.1, or explicitly configure authentication (API key or JWT) in the server config. 3) Restrict the port with firewall or security-group rules and place the service behind an authenticating reverse proxy or VPN. 4) Disable /admin/reload unless it is required. 5) Detection: search for processes running praisonai recipe serve, scan for listening ports bound to 0.0.0.0, and review access logs for unauthenticated requests to recipe and /admin/reload paths from unexpected sources. 6) Rotate LLM provider keys and tool credentials available to agents if exposure is confirmed.

How is it classified?

Auth BypassAgentFrameworkAPIAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0081- Modify AI Agent Configuration AML.T0096- AI Service API

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-56836?

Is CVE-2026-56836 actively exploited?

No confirmed active exploitation of CVE-2026-56836 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56836?

1) Upgrade PraisonAI to 4.6.59 or later. 2) Until patched, run the recipe server only on 127.0.0.1, or explicitly configure authentication (API key or JWT) in the server config. 3) Restrict the port with firewall or security-group rules and place the service behind an authenticating reverse proxy or VPN. 4) Disable /admin/reload unless it is required. 5) Detection: search for processes running `praisonai recipe serve`, scan for listening ports bound to 0.0.0.0, and review access logs for unauthenticated requests to recipe and /admin/reload paths from unexpected sources. 6) Rotate LLM provider keys and tool credentials available to agents if exposure is confirmed.

What systems are affected by CVE-2026-56836?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, agent workflow servers, LLM API gateways.

What is the CVSS score for CVE-2026-56836?

CVE-2026-56836 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationagent workflow serversLLM API gateways

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0081Modify AI Agent Configuration

AML.T0096AI Service API

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.

Exploitation Scenario

An attacker scans for exposed PraisonAI recipe servers, for example on cloud hosts where a developer ran `praisonai recipe serve --host 0.0.0.0` for a team demo. Finding one with no auth middleware, the attacker lists and invokes recipes, causing the agents to run workflows with the host's LLM API keys and tools. They then call /admin/reload to alter the loaded configuration, steering agent behavior, exfiltrating data the agents can reach, or burning the victim's token budget.

Weaknesses (CWE)

CWE-287Improper AuthenticationPrimary CWE-306Missing Authentication for Critical FunctionPrimary CWE-862Missing AuthorizationPrimary CWE-287Improper Authentication CWE-306Missing Authentication for Critical Function CWE-862Missing Authorization

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.