CVE-2026-57119: PraisonAI path traversal exposes

CISO Take

PraisonAI's Jobs API accepts an attacker-controlled agent_file path in POST /api/v1/runs and passes it straight to the job executor without a workspace allowlist or boundary check, so a remote caller can supply an absolute path or a traversal sequence and have the server open arbitrary files readable by the service account. This matters because the exploit path requires zero privileges and zero user interaction over the network (CVSS 7.5, AC:L) against an unauthenticated endpoint, meaning any internet-exposed PraisonAI deployment can have its credentials, API keys, cloud secrets, and environment variables read remotely; there is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks pre-weaponization rather than actively exploited. Blast radius depends on how many teams run PraisonAI's Jobs API exposed beyond localhost — unknown from available data, but the vendor's own fix confirms the flaw is real and trivial to trigger. Patch to 4.6.59 immediately; until then, put the Jobs API behind authentication or a network ACL and audit access logs for /api/v1/runs requests where agent_file contains an absolute path or '../' sequences.

Sources: NVD GitHub Advisory CISA KEV ATLAS

What is the risk?

High confidence, high-severity information-disclosure risk. The vulnerability requires no authentication, no user interaction, and low attack complexity (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, 7.5) — the only barrier is network reachability to the Jobs API. Impact is confidentiality-only (C:H/I:N/A:N): an attacker cannot modify data or disrupt availability, but can read any file accessible to the service account, which commonly includes .env files, cloud credentials, SSH keys, and API tokens for downstream LLM providers or vector stores. No EPSS score, CISA KEV entry, public exploit, or Nuclei template currently exists, indicating exploitation has not yet been observed in the wild, but the simplicity of the flaw (classic path traversal, CWE-22) means weaponization requires minimal effort once an internet-facing instance is identified. Actual organizational exposure depends on whether the Jobs API is reachable outside a trusted network — data on downstream dependents and package popularity was not available to quantify blast radius precisely.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated POST request to /api/v1/runs with an agent_file parameter containing an absolute path or traversal sequence.

AML.T0049

Exploitation

The job executor opens the specified file without validating it against a workspace boundary, reading arbitrary files accessible to the service account.

AML.T0037

Impact

File contents such as credentials, API keys, and environment variables are exposed to the attacker via the API response.

AML.T0055

Initial Access

Attacker sends an unauthenticated POST request to /api/v1/runs with an agent_file parameter containing an absolute path or traversal sequence.

AML.T0049

Exploitation

The job executor opens the specified file without validating it against a workspace boundary, reading arbitrary files accessible to the service account.

AML.T0037

Impact

File contents such as credentials, API keys, and environment variables are exposed to the attacker via the API response.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade to PraisonAI 4.6.59 or later, which introduces a workspace allowlist and boundary check on agent_file. If immediate patching isn't possible, place the Jobs API behind authentication (reverse proxy with auth, mTLS, or network ACL restricting access to trusted internal callers only) and do not expose it directly to the internet. Run the job executor process under a least-privilege service account with no access to secrets beyond what agent execution strictly requires, and avoid storing credentials in files reachable from the service account's filesystem view. For detection, monitor access logs and WAF rules for POST /api/v1/runs requests where agent_file contains absolute paths (leading '/' or drive letters) or traversal sequences ('../', '..\\', URL-encoded variants like %2e%2e%2f), and review recent logs retroactively for such patterns given the flaw predates the fix.

How is it classified?

Data Leakage Privacy Violation Agent Framework AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2 - Data and system security for AI systems

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-57119?

PraisonAI's Jobs API accepts an attacker-controlled agent_file path in POST /api/v1/runs and passes it straight to the job executor without a workspace allowlist or boundary check, so a remote caller can supply an absolute path or a traversal sequence and have the server open arbitrary files readable by the service account. This matters because the exploit path requires zero privileges and zero user interaction over the network (CVSS 7.5, AC:L) against an unauthenticated endpoint, meaning any internet-exposed PraisonAI deployment can have its credentials, API keys, cloud secrets, and environment variables read remotely; there is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so this looks pre-weaponization rather than actively exploited. Blast radius depends on how many teams run PraisonAI's Jobs API exposed beyond localhost — unknown from available data, but the vendor's own fix confirms the flaw is real and trivial to trigger. Patch to 4.6.59 immediately; until then, put the Jobs API behind authentication or a network ACL and audit access logs for /api/v1/runs requests where agent_file contains an absolute path or '../' sequences.

Is CVE-2026-57119 actively exploited?

No confirmed active exploitation of CVE-2026-57119 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57119?

Upgrade to PraisonAI 4.6.59 or later, which introduces a workspace allowlist and boundary check on agent_file. If immediate patching isn't possible, place the Jobs API behind authentication (reverse proxy with auth, mTLS, or network ACL restricting access to trusted internal callers only) and do not expose it directly to the internet. Run the job executor process under a least-privilege service account with no access to secrets beyond what agent execution strictly requires, and avoid storing credentials in files reachable from the service account's filesystem view. For detection, monitor access logs and WAF rules for POST /api/v1/runs requests where agent_file contains absolute paths (leading '/' or drive letters) or traversal sequences ('../', '..\\', URL-encoded variants like %2e%2e%2f), and review recent logs retroactively for such patterns given the flaw predates the fix.

What systems are affected by CVE-2026-57119?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration.

What is the CVSS score for CVE-2026-57119?

CVE-2026-57119 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestration

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files accessible to the service account, exposing credentials, keys, environment variables, and other local data. This vulnerability is fixed in 4.6.59.

Exploitation Scenario

An attacker scans for internet-exposed PraisonAI Jobs API endpoints, identifying an instance responding on POST /api/v1/runs. Without any authentication, they submit a job request with agent_file set to an absolute path such as /etc/passwd or, more valuably, a path like /app/.env or /home/service/.aws/credentials where the deployment stores secrets. The job executor opens the file as if it were a legitimate agent configuration and returns its contents (or a derivative, such as an error message echoing file contents, or an agent response processing the file as its own configuration) back through the API response. The attacker harvests LLM API keys, cloud credentials, or database connection strings from the leaked file and uses them to pivot into the victim's broader cloud environment, downstream AI services, or data stores — all without ever authenticating to the PraisonAI instance itself.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.