CVE-2026-57125: PraisonAI unauth RCE

CISO Take

PraisonAI's Jobs API (POST /api/v1/runs) accepts attacker-controlled YAML that defines an agent's tools and configuration, and a flaw in its approval logic lets that same YAML pre-mark sensitive tools like execute_command as already approved, defeating the @require_approval safeguard meant to gate dangerous actions. Because the endpoint requires no authentication and no user interaction, and the resulting impact is full arbitrary OS command execution, this is a textbook unauthenticated remote code execution path (CVSS 9.8) in any deployment exposing the Jobs API to the network. There is no CISA KEV listing and no public PoC or Nuclei template yet, but the vulnerability class — config-driven bypass of an agent's own safety gate — is trivial to weaponize once the approve-field logic is understood, and the commit-level advisory (GHSA-4869-x4pr-q22x) already documents the exact mechanism. Treat any internet- or intranet-reachable PraisonAI Jobs API as compromised-by-default until patched. Upgrade praisonai to >=4.6.59 and praisonaiagents to >=1.6.59 immediately, and in the interim place the Jobs API behind authentication/network controls and disable or tightly allowlist execute_command and other high-risk tools for any agent reachable via that endpoint.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical risk. The flaw combines the two worst exploitability properties possible: zero authentication (AV:N/PR:N/UI:N) and a full C/I/A impact via OS command execution. Attack complexity is low — the attacker only needs to POST a crafted YAML body to a known REST endpoint, no timing races, no auth tokens, no social engineering. There is no public exploit or Nuclei template yet and it is not in CISA KEV, so active mass exploitation has not been confirmed, but the advisory publishes the exact commit-level fix and the bypass logic, which materially lowers the bar for reverse-engineering a working exploit. Any organization running a PraisonAI-based agent service reachable over a network (internal or external) should treat this as pre-breach urgent regardless of current in-the-wild activity.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated POST request to the public-facing PraisonAI Jobs API endpoint /api/v1/runs.

AML.T0049

Configuration Manipulation

The request includes a crafted agent_yaml that defines an execute_command-capable agent and sets the approve field to mark that tool as pre-approved.

AML.T0081

Approval Bypass & Tool Invocation

The @require_approval check is short-circuited by the YAML-approved flag, and the agent invokes execute_command without operator interaction.

AML.T0053

Impact

Arbitrary operating-system commands execute on the host running the PraisonAI agent, giving the attacker remote code execution with the service's privileges.

AML.T0050

Initial Access

Attacker sends an unauthenticated POST request to the public-facing PraisonAI Jobs API endpoint /api/v1/runs.

AML.T0049

Configuration Manipulation

The request includes a crafted agent_yaml that defines an execute_command-capable agent and sets the approve field to mark that tool as pre-approved.

AML.T0081

Approval Bypass & Tool Invocation

The @require_approval check is short-circuited by the YAML-approved flag, and the agent invokes execute_command without operator interaction.

AML.T0053

Impact

Arbitrary operating-system commands execute on the host running the PraisonAI agent, giving the attacker remote code execution with the service's privileges.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
PraisonAI Agents	pip	—	No patch
20 dependents 59% patched ~6d to patch Full package profile →

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Patch immediately: upgrade praisonai to >=4.6.59 and praisonaiagents to >=1.6.59, which fix the approval-check bypass. Until patched, do not expose the Jobs API (/api/v1/runs) to untrusted networks — place it behind an authenticating reverse proxy or VPN, and add network-layer allowlisting. Audit any PraisonAI agent configurations for execute_command or other OS-level tool usage and disable them where not strictly required, especially on internet-facing instances. For detection, monitor PraisonAI process logs and EDR for unexpected child-process spawning from the PraisonAI service account, and alert on POST requests to /api/v1/runs containing an approve field referencing execute_command or other sensitive tools. Review recent Jobs API submissions for anomalous agent_yaml payloads as part of incident triage.

How is it classified?

Auth Bypass Code Execution Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system security controls

NIST AI RMF

MANAGE 2.3 - Mechanisms to manage risks from AI system tool/agency use

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-57125?

PraisonAI's Jobs API (POST /api/v1/runs) accepts attacker-controlled YAML that defines an agent's tools and configuration, and a flaw in its approval logic lets that same YAML pre-mark sensitive tools like execute_command as already approved, defeating the @require_approval safeguard meant to gate dangerous actions. Because the endpoint requires no authentication and no user interaction, and the resulting impact is full arbitrary OS command execution, this is a textbook unauthenticated remote code execution path (CVSS 9.8) in any deployment exposing the Jobs API to the network. There is no CISA KEV listing and no public PoC or Nuclei template yet, but the vulnerability class — config-driven bypass of an agent's own safety gate — is trivial to weaponize once the approve-field logic is understood, and the commit-level advisory (GHSA-4869-x4pr-q22x) already documents the exact mechanism. Treat any internet- or intranet-reachable PraisonAI Jobs API as compromised-by-default until patched. Upgrade praisonai to >=4.6.59 and praisonaiagents to >=1.6.59 immediately, and in the interim place the Jobs API behind authentication/network controls and disable or tightly allowlist execute_command and other high-risk tools for any agent reachable via that endpoint.

Is CVE-2026-57125 actively exploited?

No confirmed active exploitation of CVE-2026-57125 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57125?

Patch immediately: upgrade praisonai to >=4.6.59 and praisonaiagents to >=1.6.59, which fix the approval-check bypass. Until patched, do not expose the Jobs API (/api/v1/runs) to untrusted networks — place it behind an authenticating reverse proxy or VPN, and add network-layer allowlisting. Audit any PraisonAI agent configurations for execute_command or other OS-level tool usage and disable them where not strictly required, especially on internet-facing instances. For detection, monitor PraisonAI process logs and EDR for unexpected child-process spawning from the PraisonAI service account, and alert on POST requests to /api/v1/runs containing an approve field referencing execute_command or other sensitive tools. Review recent Jobs API submissions for anomalous agent_yaml payloads as part of incident triage.

What systems are affected by CVE-2026-57125?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI agent tool execution.

What is the CVSS score for CVE-2026-57125?

CVE-2026-57125 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationAI agent tool execution

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.

Exploitation Scenario

An attacker scans for or identifies an internet- or intranet-exposed PraisonAI Jobs API endpoint. Without any credentials, they send a single unauthenticated POST to /api/v1/runs with a crafted agent_yaml payload that defines an agent equipped with the execute_command tool and sets the approve field so that tool is marked as already YAML-approved, short-circuiting the @require_approval check that would normally require operator sign-off. The multi-agent runtime processes the job, the configured LLM agent decides to invoke execute_command as part of fulfilling the (attacker-defined) task, and the framework executes the attacker's chosen OS command on the host with the privileges of the PraisonAI service process — all without any human ever approving or even seeing the action.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-863 Incorrect Authorization Primary CWE-306 Missing Authentication for Critical Function CWE-863 Incorrect Authorization

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.