CVE-2026-57131: praisonai: Jobs API exposes agent-execution endpoints with no authentication
PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.createapp mounts praisonai.jobs.router.createrouter under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. This vulnerability is fixed in 4.6.58.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonai: Jobs API (praisonai.jobs.server.create_app / praisonai.jobs.router.create_router)to a version that resolves this vulnerability.Fixed in 4.6.58 - Compensating control
If upgrading to 4.6.58 is not immediately possible, restrict network access to the Jobs API endpoints under /api/v1/runs and block unauthenticated requests from untrusted clients at the network (e.g., firewall/ACL) until authentication/per-job authorization is available.
Event History
Frequently Asked Questions
Which deployments are exposed?
PraisonAI Jobs deployments using versions prior to 4.6.58 are affected when they mount the Jobs router through praisonai.jobs.server.create_app. Any network client able to reach the /api/v1/runs endpoint can interact with it.
Does exploitation require an account or user interaction?
No. The affected endpoints have no authentication or per-job authorization, and the vector is network-based with no privileges or user interaction required.
What could an unauthenticated client do?
A client can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs. This can expose service credentials and access to connected tool capabilities through unauthorized agent execution.
How can I determine whether my service is vulnerable?
Check whether the deployment uses praisonai/jobs before version 4.6.58 and whether praisonai.jobs.server.create_app mounts the router at /api/v1/runs. If that endpoint is network reachable without authentication, the described exposure applies.
What is the available remediation?
Upgrade to praisonai/jobs version 4.6.58, which fixes the issue.