CVE-2026-57147: PraisonAI hardcoded JWT secret

CISO Take

PraisonAI Platform versions before 0.1.6 fall back to a publicly known JWT signing secret ("dev-secret-change-me") when PLATFORM_JWT_SECRET is unset, and the production guard is skipped because PLATFORM_ENV defaults to dev. Anyone on the network can therefore forge an HS256 token with an arbitrary identity and be accepted by every protected API route, with no credentials, no user interaction and low complexity (CVSS 9.8). The EPSS score is low (0.77%, top 46%) and there is no public exploit, Nuclei template or KEV listing, but the flaw is trivially reproducible from the public source and fix commit, so the real-world risk is higher than the score suggests. Any deployment that was stood up with default settings and exposed beyond localhost should be treated as potentially compromised. Upgrade to praisonai-platform 0.1.6 or later, set a strong random PLATFORM_JWT_SECRET and PLATFORM_ENV=production, rotate any secrets the platform can reach, and review API logs for unexpected identities.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

High practical risk for any internet- or network-reachable PraisonAI Platform instance running with default configuration. Exploitation needs only knowledge of the public default secret and the token format, with no authentication, privileges or user interaction. Statistical exploitation likelihood is low (EPSS 0.00772) and no public exploit or KEV entry exists, but the barrier is close to zero for anyone who reads the fix commit or advisory. Instances that set PLATFORM_JWT_SECRET explicitly are not affected. The impact is full confidentiality, integrity and availability loss on the platform and the agent workloads it manages.

How does the attack unfold?

Reconnaissance

Attacker locates an exposed PraisonAI Platform instance and confirms it runs a version before 0.1.6 with default settings.

AML.T0006

Token Forgery

Attacker signs an HS256 JWT with the public default secret and an arbitrary sub and email.

AML.T0091.000

Initial Access

The forged token passes _verify_token() and get_current_user, granting access to protected API routes.

AML.T0049

Impact

Attacker reads or modifies agents, steals stored credentials and API keys, and abuses agent tools to pivot further.

AML.T0053

Reconnaissance

Attacker locates an exposed PraisonAI Platform instance and confirms it runs a version before 0.1.6 with default settings.

AML.T0006

Token Forgery

Attacker signs an HS256 JWT with the public default secret and an arbitrary sub and email.

AML.T0091.000

Initial Access

The forged token passes _verify_token() and get_current_user, granting access to protected API routes.

AML.T0049

Impact

Attacker reads or modifies agents, steals stored credentials and API keys, and abuses agent tools to pivot further.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 56% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade praisonai-platform to 0.1.6 or later (fix in PR #1793 / commit e0fb8e7; see GHSA-cwj8-7gp2-ggcw). 2) Set PLATFORM_JWT_SECRET to a long random value from a secrets manager and set PLATFORM_ENV=production so the production guard runs. 3) Rotate the JWT secret and invalidate all existing sessions, since tokens signed with the default secret remain valid until it changes. 4) Rotate LLM provider keys, tool credentials and any secrets accessible to the platform if exposure is suspected. 5) Restrict network access to the platform API (VPN, IP allowlist, reverse proxy with authentication). 6) Detect: look for tokens whose sub or email do not match known users, requests from unfamiliar IPs using valid-looking tokens, and unexpected agent or configuration changes. Also scan configs and environments for deployments still using the default secret.

How is it classified?

Auth BypassAgentAPIFrameworkAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-57147?

PraisonAI Platform versions before 0.1.6 fall back to a publicly known JWT signing secret ("dev-secret-change-me") when PLATFORM_JWT_SECRET is unset, and the production guard is skipped because PLATFORM_ENV defaults to dev. Anyone on the network can therefore forge an HS256 token with an arbitrary identity and be accepted by every protected API route, with no credentials, no user interaction and low complexity (CVSS 9.8). The EPSS score is low (0.77%, top 46%) and there is no public exploit, Nuclei template or KEV listing, but the flaw is trivially reproducible from the public source and fix commit, so the real-world risk is higher than the score suggests. Any deployment that was stood up with default settings and exposed beyond localhost should be treated as potentially compromised. Upgrade to praisonai-platform 0.1.6 or later, set a strong random PLATFORM_JWT_SECRET and PLATFORM_ENV=production, rotate any secrets the platform can reach, and review API logs for unexpected identities.

Is CVE-2026-57147 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57147, increasing the risk of exploitation.

How to fix CVE-2026-57147?

1) Upgrade praisonai-platform to 0.1.6 or later (fix in PR #1793 / commit e0fb8e7; see GHSA-cwj8-7gp2-ggcw). 2) Set PLATFORM_JWT_SECRET to a long random value from a secrets manager and set PLATFORM_ENV=production so the production guard runs. 3) Rotate the JWT secret and invalidate all existing sessions, since tokens signed with the default secret remain valid until it changes. 4) Rotate LLM provider keys, tool credentials and any secrets accessible to the platform if exposure is suspected. 5) Restrict network access to the platform API (VPN, IP allowlist, reverse proxy with authentication). 6) Detect: look for tokens whose sub or email do not match known users, requests from unfamiliar IPs using valid-looking tokens, and unexpected agent or configuration changes. Also scan configs and environments for deployments still using the default secret.

What systems are affected by CVE-2026-57147?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration platforms, AI agent management APIs.

What is the CVSS score for CVE-2026-57147?

CVE-2026-57147 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.77%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestration platformsAI agent management APIs

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET is unset, and its production guard does not run when PLATFORM_ENV is also unset because that setting defaults to dev. A remote unauthenticated attacker can mint an HS256 token with an arbitrary sub and email, and the platform's AuthService._verify_token() and get_current_user dependency accept the forged identity for protected API routes. This vulnerability is fixed in praisonai-platform 0.1.6.

Exploitation Scenario

An attacker finds an exposed PraisonAI Platform instance through internet scanning or a leaked URL. They read the public source to get the default secret "dev-secret-change-me" and craft an HS256 JWT with the sub and email of an administrator. Sending it as a bearer token to protected endpoints, they are accepted as that user. They then list and modify agents, extract stored LLM API keys and tool credentials, alter agent instructions or tool bindings to run malicious actions, and use the agents' tool access to pivot into connected internal systems.

Weaknesses (CWE)

CWE-1188Initialization of a Resource with an Insecure DefaultPrimary CWE-798Use of Hard-coded CredentialsPrimary CWE-1188Initialization of a Resource with an Insecure Default CWE-798Use of Hard-coded Credentials

CWE-1188 — Initialization of a Resource with an Insecure Default: The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Source: MITRE CWE corpus.