PT-2026-61781 · Praisonai · Praisonai
CVE-2026-57127
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
praisonai version 4.6.48
Description
The
recipe serve authentication middleware fails open when no secret is configured. Specifically, the APIKeyAuthMiddleware and JWTAuthMiddleware in praisonai/recipe/serve.py contain logic that allows requests to proceed without authentication if the expected API key or JWT secret is not set in the recipe YAML or the environment variables PRAISONAI API KEY and PRAISONAI JWT SECRET. This occurs even if the operator has explicitly requested authentication by setting auth: api-key or auth: jwt in the configuration.This issue allows unauthenticated users to trigger arbitrary recipe executions with attacker-controlled inputs, read inputs and outputs of in-flight recipes, and potentially achieve remote code execution (RCE) if the recipe execution surface is connected to tools such as browser automation or file-system writes. The vulnerability is triggered within the
dispatch() function of the affected middleware classes.Recommendations
For version 4.6.48, ensure that a valid secret is provided via the
api key or jwt secret fields in the recipe YAML, or by exporting the PRAISONAI API KEY or PRAISONAI JWT SECRET environment variables.
As a temporary mitigation, avoid using the auth: api-key or auth: jwt settings unless the corresponding secrets are strictly configured to prevent silent authentication bypass.Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai