CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.62 are vulnerable due to a misconfiguration that allows unauthenticated requests to invoke agent actions when the PRAISONAI_CALL_AUTH setting is disabled. This can lead to unauthorized access to registered agents and their associated tools or private context, posing a significant security risk. Organizations using affected versions should prioritize upgrading to 4.6.62 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.6.62.