CVE-2026-57132: PraisonAI auth bypass on agent invoke

CISO Take

PraisonAI, a multi-agent orchestration framework, ships an opt-out flag (PRAISONAI_CALL_AUTH=disabled) that, when set, makes the token-verification function silently accept unauthenticated requests to the agent invocation API instead of rejecting them. Any deployment that used this advertised opt-out is reachable over the network with no privileges and no user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N), letting an attacker directly invoke registered agents and reach whatever tools or private context those agents are wired to — a high-confidentiality-impact scenario for any RAG store, credential, or internal API an agent can touch. There is no EPSS score, no CISA KEV listing, and no public exploit or scanner template yet, so this looks opportunistic rather than actively weaponized today, but the fix is a one-line config check that's trivial to find once the advisory is public. Action: upgrade to PraisonAI 4.6.62 or later immediately, and in the interim confirm PRAISONAI_CALL_AUTH is not set to disabled on any internet- or network-reachable deployment; audit logs for unauthenticated calls to /api/v1/agents/{id}/invoke as an indicator of prior exposure.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High severity (CVSS 8.2) driven by a fully remote, zero-privilege, zero-interaction path (AV:N/AC:L/PR:N/UI:N) with a high confidentiality impact — an attacker who reaches an exposed instance gets equivalent access to a legitimate caller of the agent invoke API. Integrity impact is only low and availability is unaffected, so this is primarily an unauthorized-access/data-exposure risk rather than a takeover or DoS vector. Real-world risk is gated entirely by whether an operator opted into PRAISONAI_CALL_AUTH=disabled and left the resulting endpoint network-reachable; there's no evidence yet of active exploitation, no KEV entry, no EPSS score, and no public PoC or nuclei template, which lowers near-term urgency but does not reduce the severity if an affected instance is internet-facing.

How does the attack unfold?

Discovery

Attacker identifies a network-reachable PraisonAI deployment configured with PRAISONAI_CALL_AUTH set to disabled.

AML.T0049

Auth bypass invocation

Attacker sends an unauthenticated request to /api/v1/agents/{id}/invoke, which verify_token accepts due to the disabled auth check.

AML.T0053

Tool and context access

The invoked agent processes the attacker's input using its connected tools and private context as if the caller were trusted.

AML.T0085.001

Impact

Sensitive data or tool output is exposed to the unauthenticated attacker, resulting in a confidentiality breach of the agent's context and connected systems.

AML.T0024

Discovery

Attacker identifies a network-reachable PraisonAI deployment configured with PRAISONAI_CALL_AUTH set to disabled.

AML.T0049

Auth bypass invocation

Attacker sends an unauthenticated request to /api/v1/agents/{id}/invoke, which verify_token accepts due to the disabled auth check.

AML.T0053

Tool and context access

The invoked agent processes the attacker's input using its connected tools and private context as if the caller were trusted.

AML.T0085.001

Impact

Sensitive data or tool output is exposed to the unauthenticated attacker, resulting in a confidentiality breach of the agent's context and connected systems.

AML.T0024

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I Low

A None

What should I do?

1 step

1) Upgrade PraisonAI to 4.6.62 or later, which fixes verify_token to properly enforce CALL_SERVER_TOKEN regardless of the disabled setting. 2) Until patched, do not set PRAISONAI_CALL_AUTH=disabled; if it is currently set, either re-enable auth or place the invoke API behind a network control (VPN, allow-list, reverse-proxy auth) that is not dependent on the application's own token check. 3) Rotate CALL_SERVER_TOKEN and any credentials/context reachable by affected agents' tools, since past exposure cannot be ruled out retroactively. 4) Monitor access logs for calls to /api/v1/agents/{id}/invoke lacking a valid Authorization header, and alert on invoke traffic from unexpected source IPs. 5) Review agent tool configurations to ensure least-privilege scoping, limiting blast radius if the endpoint is reached again in the future.

How is it classified?

Auth Bypass Data Leakage Agent API AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084 - Discover AI Agent Configuration AML.T0085.001 - AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6 - AI system operational security controls

NIST AI RMF

MANAGE 4.1 - AI system risks and benefits are monitored, and mechanisms for updating risk controls are in place

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-57132?

PraisonAI, a multi-agent orchestration framework, ships an opt-out flag (PRAISONAI_CALL_AUTH=disabled) that, when set, makes the token-verification function silently accept unauthenticated requests to the agent invocation API instead of rejecting them. Any deployment that used this advertised opt-out is reachable over the network with no privileges and no user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N), letting an attacker directly invoke registered agents and reach whatever tools or private context those agents are wired to — a high-confidentiality-impact scenario for any RAG store, credential, or internal API an agent can touch. There is no EPSS score, no CISA KEV listing, and no public exploit or scanner template yet, so this looks opportunistic rather than actively weaponized today, but the fix is a one-line config check that's trivial to find once the advisory is public. Action: upgrade to PraisonAI 4.6.62 or later immediately, and in the interim confirm PRAISONAI_CALL_AUTH is not set to disabled on any internet- or network-reachable deployment; audit logs for unauthenticated calls to /api/v1/agents/{id}/invoke as an indicator of prior exposure.

Is CVE-2026-57132 actively exploited?

No confirmed active exploitation of CVE-2026-57132 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57132?

1) Upgrade PraisonAI to 4.6.62 or later, which fixes verify_token to properly enforce CALL_SERVER_TOKEN regardless of the disabled setting. 2) Until patched, do not set PRAISONAI_CALL_AUTH=disabled; if it is currently set, either re-enable auth or place the invoke API behind a network control (VPN, allow-list, reverse-proxy auth) that is not dependent on the application's own token check. 3) Rotate CALL_SERVER_TOKEN and any credentials/context reachable by affected agents' tools, since past exposure cannot be ruled out retroactively. 4) Monitor access logs for calls to /api/v1/agents/{id}/invoke lacking a valid Authorization header, and alert on invoke traffic from unexpected source IPs. 5) Review agent tool configurations to ensure least-privilege scoping, limiting blast radius if the endpoint is reached again in the future.

What systems are affected by CVE-2026-57132?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI agent tool invocation endpoints.

What is the CVSS score for CVE-2026-57132?

CVE-2026-57132 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationAI agent tool invocation endpoints

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084 Discover AI Agent Configuration

AML.T0085.001 AI Agent Tools

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.6.62.

Exploitation Scenario

An attacker scans for internet- or network-exposed PraisonAI deployments (e.g., via Shodan-style fingerprinting of the API surface or by targeting known customer infrastructure). Finding an instance where the operator followed the documented opt-out and set PRAISONAI_CALL_AUTH=disabled, the attacker sends a direct POST to /api/v1/agents/{id}/invoke without any CALL_SERVER_TOKEN. verify_token accepts the request, and the attacker's crafted input is processed by the registered agent exactly as if it came from a trusted caller — triggering the agent's connected tools (e.g., internal data lookups, RAG retrieval, or third-party API calls) and returning private context or tool output directly to the attacker, with no authentication log trail beyond the raw HTTP request.

Weaknesses (CWE)

CWE-287 Improper Authentication Primary CWE-287 Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.