Vulnerability Description
PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET and the corresponding recipe value are absent. Unauthenticated clients can then reach recipe execution, input, and output surfaces and may trigger connected tools despite the operator explicitly enabling authentication. This issue is fixed in 4.6.58.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828f
- https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4hj-7hfh-g2
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4hj-7hfh-g2
FAQ
What is CVE-2026-57127?
CVE-2026-57127 is a vulnerability with a CVSS score of 9.8 (CRITICAL). PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware fo...
How severe is CVE-2026-57127?
CVE-2026-57127 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-57127?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.