HIGH

CVE-2026-57132

2026-09-14 CVSS v3.1

CVSS

8.2

Description

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.6.62.

Weakness (CWE)

CWE-287 Improper Authentication

EPSS Score

0.29%

Probability of exploitation in next 30 days

21.7th percentile

References

https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33 https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8ccj-p46r-jwqq

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE