CVE-2026-56836: PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, createapp() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated access?
PraisonAI versions 4.5.112 through 4.6.58 are affected when the installed console entrypoint is used to run "praisonai recipe serve" and the server is started on a non-localhost interface. The deprecated Typer command can expose the Recipe HTTP server without authentication.
Does an attacker need credentials or user interaction to exploit this?
No. The issue is network-accessible and requires no privileges or user interaction. Unauthenticated requests can reach the recipe API, including /admin/reload when that endpoint is enabled.
How can I determine whether a running server may be affected?
Check whether the deployment uses an affected version and was launched with "praisonai recipe serve" through the installed console entrypoint. A deprecation warning from the Typer command is an indicator that this command path is being used; the vulnerable path starts the server without config.auth, so API-key and JWT middleware are not attached.
What should be done if upgrading is not immediately possible?
Do not expose the Recipe HTTP server on a non-localhost interface through the affected Typer command path. Restrict the service to localhost or otherwise prevent untrusted network access until it can be updated to version 4.6.59.