CVE-2026-55533CWE-287CWE-306

CVE-2026-55533

High · published August 25, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled. This issue is fixed in version 4.6.58.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-08-25T20:16Z
References (4)
https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1 · [email protected]https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58 · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gfq8-hmph-9gjv · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gfq8-hmph-9gjv · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:36Z
    EPSS moved — → 0%
    epss
  • 25 AUG 15:15Z
    PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret
    cvelistv5