CVE-2026-61435: PraisonAI Host header spoof bypasses

CISO Take

PraisonAI's Call API ships an opt-in insecure mode (PRAISONAI_CALL_AUTH=disabled) meant only for localhost, but the code determines 'local' by reading the client-controlled HTTP Host header instead of the actual socket peer — so any remote attacker can send Host: 127.0.0.1 and unlock the API. This matters because the affected endpoints list and invoke registered AI agents (GET /api/v1/agents, POST /api/v1/agents/{id}/invoke) with zero authentication, network access, and no user interaction, and CVSS scores it 8.2 (AC:L, PR:N) reflecting how trivial it is to trigger. There's no EPSS score or CISA KEV listing yet and no public exploit or Nuclei template has surfaced, so this looks pre-exploitation rather than actively weaponized, but the fix is a one-line-config mistake pattern likely to recur in other self-hosted agent frameworks. Only 1 tracked downstream dependent is currently exposed via this pipeline, but any deployment that ever enabled PRAISONAI_CALL_AUTH=disabled and is network-reachable (not just localhost) is exploitable today. Patch to PraisonAI 4.6.78+, and treat PRAISONAI_CALL_AUTH=disabled as unsafe for any host that isn't strictly firewalled to loopback regardless of the app-level check.

Sources: NVD GitHub Advisory CISA KEV ATLAS vulncheck.com

What is the risk?

High severity but conditional: exploitation requires the operator to have opted into PRAISONAI_CALL_AUTH=disabled, which is documented as a localhost-only convenience setting. Where that condition holds, exploitability is trivial — a single spoofed Host header, no credentials, no user interaction, low complexity (CVSS AC:L, PR:N, UI:N). Impact per the vector is confidentiality-low/integrity-high/availability-none (C:L/I:H/A:N), meaning the primary risk is unauthorized manipulation via agent invocation rather than mass data exfiltration or service disruption. No EPSS percentile, KEV listing, public PoC, or scanner template exists yet, so real-world exploitation activity is unconfirmed — this is a 'patch before it's targeted' situation, not an active-incident one.

How does the attack unfold?

Recon

Attacker identifies a network-reachable PraisonAI Call API instance running with PRAISONAI_CALL_AUTH=disabled.

AML.T0006

Auth Bypass via Host Header Spoofing

Attacker sends requests with a forged 'Host: 127.0.0.1' header, exploiting the flawed localhost check to disable authentication remotely.

AML.T0049

Agent Enumeration

Attacker calls GET /api/v1/agents to list registered agents and their configurations without credentials.

AML.T0084

Unauthorized Agent Invocation

Attacker calls POST /api/v1/agents/{agent_id}/invoke to execute agent actions and abuse whatever tools/integrations the agent has access to.

AML.T0053

Recon

Attacker identifies a network-reachable PraisonAI Call API instance running with PRAISONAI_CALL_AUTH=disabled.

AML.T0006

Auth Bypass via Host Header Spoofing

Attacker sends requests with a forged 'Host: 127.0.0.1' header, exploiting the flawed localhost check to disable authentication remotely.

AML.T0049

Agent Enumeration

Attacker calls GET /api/v1/agents to list registered agents and their configurations without credentials.

AML.T0084

Unauthorized Agent Invocation

Attacker calls POST /api/v1/agents/{agent_id}/invoke to execute agent actions and abuse whatever tools/integrations the agent has access to.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I High

A None

What should I do?

1 step

Upgrade to PraisonAI 4.6.78 or later, which fixes the host-derivation logic per the linked GitHub commits. Until patched, do not rely on PRAISONAI_CALL_AUTH=disabled for security — treat it as equivalent to 'no auth' and enforce isolation at the network layer (bind the service to 127.0.0.1 at the OS/socket level, or block external access with a firewall/security group, not just app-level Host header inspection). Audit any internet- or intranet-exposed PraisonAI instances for this environment variable being set. For detection, monitor access logs for GET /api/v1/agents or POST /api/v1/agents/*/invoke requests carrying a Host: 127.0.0.1 (or other loopback) header that did not originate from the local interface — this is a strong indicator of exploitation attempts.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent API AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system security controls across the lifecycle

OWASP LLM Top 10

LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-61435?

PraisonAI's Call API ships an opt-in insecure mode (PRAISONAI_CALL_AUTH=disabled) meant only for localhost, but the code determines 'local' by reading the client-controlled HTTP Host header instead of the actual socket peer — so any remote attacker can send Host: 127.0.0.1 and unlock the API. This matters because the affected endpoints list and invoke registered AI agents (GET /api/v1/agents, POST /api/v1/agents/{id}/invoke) with zero authentication, network access, and no user interaction, and CVSS scores it 8.2 (AC:L, PR:N) reflecting how trivial it is to trigger. There's no EPSS score or CISA KEV listing yet and no public exploit or Nuclei template has surfaced, so this looks pre-exploitation rather than actively weaponized, but the fix is a one-line-config mistake pattern likely to recur in other self-hosted agent frameworks. Only 1 tracked downstream dependent is currently exposed via this pipeline, but any deployment that ever enabled PRAISONAI_CALL_AUTH=disabled and is network-reachable (not just localhost) is exploitable today. Patch to PraisonAI 4.6.78+, and treat PRAISONAI_CALL_AUTH=disabled as unsafe for any host that isn't strictly firewalled to loopback regardless of the app-level check.

Is CVE-2026-61435 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61435, increasing the risk of exploitation.

How to fix CVE-2026-61435?

Upgrade to PraisonAI 4.6.78 or later, which fixes the host-derivation logic per the linked GitHub commits. Until patched, do not rely on PRAISONAI_CALL_AUTH=disabled for security — treat it as equivalent to 'no auth' and enforce isolation at the network layer (bind the service to 127.0.0.1 at the OS/socket level, or block external access with a firewall/security group, not just app-level Host header inspection). Audit any internet- or intranet-exposed PraisonAI instances for this environment variable being set. For detection, monitor access logs for GET /api/v1/agents or POST /api/v1/agents/*/invoke requests carrying a Host: 127.0.0.1 (or other loopback) header that did not originate from the local interface — this is a strong indicator of exploitation attempts.

What systems are affected by CVE-2026-61435?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent APIs, agent orchestration.

What is the CVSS score for CVE-2026-61435?

CVE-2026-61435 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.69%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent APIsagent orchestration

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

OWASP LLM Top 10: LLM08:2025

What are the technical details?

Original Advisory

PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agent_invoke.py) when PRAISONAI_CALL_AUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host from request.url.hostname, which is taken from the client-controlled HTTP Host header. A remote, unauthenticated attacker who can reach the service over the network can send a spoofed 'Host: 127.0.0.1' header to bypass the localhost-only restriction and list (GET /api/v1/agents) and invoke (POST /api/v1/agents/{agent_id}/invoke) registered agents without authentication.

Exploitation Scenario

An attacker scans for internet- or corporate-network-reachable PraisonAI Call API instances (e.g., a dev/staging agent server left reachable beyond localhost with PRAISONAI_CALL_AUTH=disabled for convenience). They send a GET request to /api/v1/agents with a forged 'Host: 127.0.0.1' header; the flawed localhost check trusts the header and serves the full list of registered agents and their metadata without authentication. The attacker then picks a high-value agent and sends POST /api/v1/agents/{agent_id}/invoke with the same spoofed header, causing the agent to execute its configured tools/actions on the attacker's behalf — potentially reading files, calling internal APIs, or interacting with other connected systems, all without ever presenting valid credentials.

Weaknesses (CWE)

CWE-287 Improper Authentication Primary CWE-287 Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.