CVE-2026-57131: PraisonAI no-auth API exposes

CISO Take

PraisonAI's job orchestration API, mounted at /api/v1/runs, ships with zero authentication and zero per-job authorization prior to version 4.6.58, meaning anyone who can reach the service over the network can submit arbitrary prompts and agent configurations, list and stream other users' job output, and cancel or delete jobs that aren't theirs. This is a maximum-severity flaw (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) on an agent framework, where a successful hit doesn't just leak data — it hands the attacker the ability to drive whatever tools and service credentials the agent has wired up, turning an internal automation surface into an open command console. There's no EPSS score or CISA KEV listing yet and no public exploit or Nuclei template has surfaced, so this looks pre-weaponization rather than actively exploited, but the fix is a one-line dependency bump and the exposure (any network-reachable deployment) is trivial to find. Patch to praisonai >= 4.6.58 immediately; until then, put the jobs API behind an authenticating reverse proxy or restrict it to a trusted network, and audit access/job logs for job creation or listing from unexpected source IPs or without an authenticated session.

Sources: NVD GitHub Advisory CISA KEV ATLAS

What is the risk?

Critical. The combination of network exposure, zero attack complexity, no privileges required, and no user interaction (CVSS 9.8) with an unauthenticated endpoint that grants full read/write/delete control over agent jobs makes this trivially exploitable by any actor who can reach the service. Impact is compounded because the affected surface is an AI agent orchestration layer with access to connected tools and service credentials — exploitation isn't limited to data disclosure but extends to arbitrary agent execution under attacker control. The only mitigating factor is that exploitation requires network reachability to the PraisonAI jobs API, which may be limited in deployments that keep it internal-only, but no authentication means any lateral movement or exposed port turns into full compromise.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated HTTP request to the exposed /api/v1/runs endpoint of a PraisonAI deployment.

AML.T0049

Job Enumeration

Attacker lists and reads existing jobs, exposing other users' agent configurations, service credentials, and streamed outputs.

AML.T0084

Malicious Execution

Attacker submits a new job with an attacker-controlled prompt and agent configuration to invoke connected tools for their own benefit.

AML.T0053

Impact

Attacker cancels or deletes legitimate users' jobs, causing service disruption and covering traces of the intrusion.

AML.T0101

Initial Access

Attacker sends an unauthenticated HTTP request to the exposed /api/v1/runs endpoint of a PraisonAI deployment.

AML.T0049

Job Enumeration

Attacker lists and reads existing jobs, exposing other users' agent configurations, service credentials, and streamed outputs.

AML.T0084

Malicious Execution

Attacker submits a new job with an attacker-controlled prompt and agent configuration to invoke connected tools for their own benefit.

AML.T0053

Impact

Attacker cancels or deletes legitimate users' jobs, causing service disruption and covering traces of the intrusion.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

1.0%

chance of exploitation in 30 days

Higher than 60% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade praisonai to version 4.6.58 or later immediately, which adds authentication and per-job authorization to the jobs router. If immediate upgrade isn't possible, do not expose the /api/v1/runs endpoint directly to untrusted networks — place it behind an authenticating reverse proxy (mTLS, API gateway with auth, or VPN-only access) and apply network-level restrictions (firewall/security group rules limiting source IPs). Rotate any service credentials or API keys that PraisonAI agents had access to, since they may have been exposed to unauthorized job submissions before patching. For detection, review PraisonAI job logs for job creation, listing, or deletion events from unexpected or unauthenticated source IPs, unusual prompt content, or job cancellation/deletion patterns inconsistent with legitimate users.

How is it classified?

Auth Bypass Code Execution Data Leakage Framework Agent API AML.T0049 - Exploit Public-Facing Application AML.T0051.000 - Direct AML.T0053 - AI Agent Tool Invocation AML.T0083 - Credentials from AI Agent Configuration AML.T0084 - Discover AI Agent Configuration AML.T0101 - Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-57131?

PraisonAI's job orchestration API, mounted at /api/v1/runs, ships with zero authentication and zero per-job authorization prior to version 4.6.58, meaning anyone who can reach the service over the network can submit arbitrary prompts and agent configurations, list and stream other users' job output, and cancel or delete jobs that aren't theirs. This is a maximum-severity flaw (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) on an agent framework, where a successful hit doesn't just leak data — it hands the attacker the ability to drive whatever tools and service credentials the agent has wired up, turning an internal automation surface into an open command console. There's no EPSS score or CISA KEV listing yet and no public exploit or Nuclei template has surfaced, so this looks pre-weaponization rather than actively exploited, but the fix is a one-line dependency bump and the exposure (any network-reachable deployment) is trivial to find. Patch to praisonai >= 4.6.58 immediately; until then, put the jobs API behind an authenticating reverse proxy or restrict it to a trusted network, and audit access/job logs for job creation or listing from unexpected source IPs or without an authenticated session.

Is CVE-2026-57131 actively exploited?

No confirmed active exploitation of CVE-2026-57131 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57131?

Upgrade praisonai to version 4.6.58 or later immediately, which adds authentication and per-job authorization to the jobs router. If immediate upgrade isn't possible, do not expose the /api/v1/runs endpoint directly to untrusted networks — place it behind an authenticating reverse proxy (mTLS, API gateway with auth, or VPN-only access) and apply network-level restrictions (firewall/security group rules limiting source IPs). Rotate any service credentials or API keys that PraisonAI agents had access to, since they may have been exposed to unauthorized job submissions before patching. For detection, review PraisonAI job logs for job creation, listing, or deletion events from unexpected or unauthenticated source IPs, unusual prompt content, or job cancellation/deletion patterns inconsistent with legitimate users.

What systems are affected by CVE-2026-57131?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI agent tool integrations.

What is the CVSS score for CVE-2026-57131?

CVE-2026-57131 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.97%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationAI agent tool integrations

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0051.000 Direct

AML.T0053 AI Agent Tool Invocation

AML.T0083 Credentials from AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

AML.T0101 Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. This vulnerability is fixed in 4.6.58.

Exploitation Scenario

An attacker scans for internet- or intranet-reachable PraisonAI deployments and finds an instance exposing /api/v1/runs without any authentication challenge. The attacker first calls the list-jobs endpoint to enumerate existing jobs, discovering agent configurations and job outputs belonging to legitimate users — potentially revealing service credentials or connected tool details embedded in job configs. The attacker then submits a new job with a crafted prompt and agent configuration designed to invoke the agent's connected tools (e.g., file access, external API calls, or code execution tools) for the attacker's benefit, effectively hijacking the victim's agent infrastructure. To cover tracks or cause disruption, the attacker cancels or deletes other users' in-flight jobs, denying service and destroying evidence of the intrusion.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function CWE-306 Missing Authentication for Critical Function CWE-862 Missing Authorization CWE-862 Missing Authorization CWE-94 Improper Control of Generation of Code ('Code Injection') CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.