CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.58 are vulnerable due to improper authentication handling, allowing unauthenticated clients to access recipe execution, input, and output surfaces even when API key or JWT authentication is enabled. This critical flaw could lead to unauthorized execution of connected tools, posing significant security risks. Organizations using affected versions should prioritize upgrading to 4.6.58 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET and the corresponding recipe value are absent. Unauthenticated clients can then reach recipe execution, input, and output surfaces and may trigger connected tools despite the operator explicitly enabling authentication. This issue is fixed in 4.6.58.