HIGH

CVE-2026-57134

2026-09-15 CVSS v3.1

CVSS

8.2

Description

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2.

Weakness (CWE)

CWE-287 Improper Authentication

CWE-288

CWE-863 Incorrect Authorization

EPSS Score

0.31%

Probability of exploitation in next 30 days

23.4th percentile

References

https://github.com/MervinPraison/PraisonAI/commit/709a0387853709a5e2f2c34680fa64cada252c27 https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.60 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4qq2-2j2x-x62c

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE