CVE-2026-57148: PraisonAI hardcoded JWT secret

CISO Take

PraisonAI's platform service falls back to a publicly known HS256 signing key (dev-secret-change-me) when PLATFORM_JWT_SECRET is unset, and its dev-mode guards are disabled by default, so anyone can forge a valid JWT for any user or workspace owner whose identifier they know. The flaw is rated critical (CVSS 9.8) with network access, no privileges and no user interaction needed, and CISA SSVC rates it ATTEND. Exploitation signals are currently low: EPSS is 0.00641 (top 51%), it is not in CISA KEV, and there is no public exploit or Nuclei template. However, forging a token needs only a known secret and a target ID, so weaponization would be trivial. Upgrade praisonai-platform to 0.1.6 or later, and explicitly set a strong random PLATFORM_JWT_SECRET and PLATFORM_ENV=production on every deployment. Rotate all sessions and review authentication logs for unexpected identities, since any instance deployed with defaults must be treated as exposed.

Sources:NVDEPSSGitHub AdvisoryATLASCISA SSVC

What is the risk?

High to critical for any internet-reachable PraisonAI platform deployed with default environment settings. The attack is unauthenticated, low-complexity and network-based, and it needs only a guessable or known user or workspace identifier. Current exploitation likelihood is low (EPSS 0.64%, no KEV listing, no public PoC), but the secret is public in the source code, so the barrier to exploitation is minimal. Package risk data is unavailable (dependents unknown, OpenSSF N/A), so blast radius is hard to quantify. Exposure is limited to deployments that run the platform service without setting the secret.

How does the attack unfold?

Reconnaissance

The attacker identifies an exposed PraisonAI platform and obtains a target user or workspace-owner identifier.

AML.T0006

Token Forgery

The attacker signs an HS256 JWT with the public default key dev-secret-change-me and an attacker-chosen sub value.

AML.T0091.000

Initial Access

The platform's _verify_token() accepts the forged token and treats the attacker as the authenticated owner.

AML.T0049

Impact

The attacker accesses workspaces, steals stored credentials, and manipulates agents and their tool invocations.

AML.T0053

Reconnaissance

The attacker identifies an exposed PraisonAI platform and obtains a target user or workspace-owner identifier.

AML.T0006

Token Forgery

The attacker signs an HS256 JWT with the public default key dev-secret-change-me and an attacker-chosen sub value.

AML.T0091.000

Initial Access

The platform's _verify_token() accepts the forged token and treats the attacker as the authenticated owner.

AML.T0049

Impact

The attacker accesses workspaces, steals stored credentials, and manipulates agents and their tool invocations.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade praisonai-platform to 0.1.6 or later (fixed in PraisonAI release v4.6.51). 2) Set PLATFORM_JWT_SECRET to a long random value and PLATFORM_ENV to a non-dev value so startup guards are enforced. 3) Rotate the signing secret, invalidate all existing sessions and tokens, and rotate API keys and provider credentials stored in affected workspaces. 4) Restrict network exposure of the platform with a VPN, IP allowlist or authenticating reverse proxy until patched. 5) Detection: review logs for JWTs issued outside the normal flow, sessions from unfamiliar IPs, or workspace-owner actions without a corresponding login event. You can test whether tokens signed with the default key are accepted in a controlled check of your own instances.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassFrameworkAgentAPIAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risksMEASURE 2.7-AI system security and resilience evaluated

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-57148?

PraisonAI's platform service falls back to a publicly known HS256 signing key (dev-secret-change-me) when PLATFORM_JWT_SECRET is unset, and its dev-mode guards are disabled by default, so anyone can forge a valid JWT for any user or workspace owner whose identifier they know. The flaw is rated critical (CVSS 9.8) with network access, no privileges and no user interaction needed, and CISA SSVC rates it ATTEND. Exploitation signals are currently low: EPSS is 0.00641 (top 51%), it is not in CISA KEV, and there is no public exploit or Nuclei template. However, forging a token needs only a known secret and a target ID, so weaponization would be trivial. Upgrade praisonai-platform to 0.1.6 or later, and explicitly set a strong random PLATFORM_JWT_SECRET and PLATFORM_ENV=production on every deployment. Rotate all sessions and review authentication logs for unexpected identities, since any instance deployed with defaults must be treated as exposed.

Is CVE-2026-57148 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-57148, increasing the risk of exploitation.

How to fix CVE-2026-57148?

1) Upgrade praisonai-platform to 0.1.6 or later (fixed in PraisonAI release v4.6.51). 2) Set PLATFORM_JWT_SECRET to a long random value and PLATFORM_ENV to a non-dev value so startup guards are enforced. 3) Rotate the signing secret, invalidate all existing sessions and tokens, and rotate API keys and provider credentials stored in affected workspaces. 4) Restrict network exposure of the platform with a VPN, IP allowlist or authenticating reverse proxy until patched. 5) Detection: review logs for JWTs issued outside the normal flow, sessions from unfamiliar IPs, or workspace-owner actions without a corresponding login event. You can test whether tokens signed with the default key are accepted in a controlled check of your own instances.

What systems are affected by CVE-2026-57148?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration platforms, agent management APIs.

What is the CVSS score for CVE-2026-57148?

CVE-2026-57148 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.64%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestration platformsagent management APIs

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3, MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET is unset, while the startup and token-issuance guards are disabled because PLATFORM_ENV also defaults to dev. An unauthenticated attacker can sign a JWT containing an attacker-chosen sub value, and AuthService._verify_token() accepts it as an authenticated identity, enabling user or workspace-owner impersonation when a target identifier is known. This vulnerability is fixed in praisonai-platform 0.1.6.

Exploitation Scenario

An attacker finds an internet-exposed PraisonAI platform and learns a workspace owner's user ID from a public repository, shared link, error message or enumeration. The attacker signs an HS256 JWT with the public key dev-secret-change-me and sets the sub claim to the owner's ID. The platform's _verify_token() accepts it, giving full owner-level access. The attacker then exports agent configurations and stored provider API keys, modifies agents to run attacker-controlled tools or exfiltrate data, and abuses the victim's LLM quota.

Weaknesses (CWE)

CWE-1188Initialization of a Resource with an Insecure DefaultPrimary CWE-287Improper AuthenticationPrimary CWE-798Use of Hard-coded CredentialsPrimary CWE-1188Initialization of a Resource with an Insecure Default CWE-287Improper Authentication CWE-798Use of Hard-coded Credentials

CWE-1188 — Initialization of a Resource with an Insecure Default: The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Source: MITRE CWE corpus.