CVE-2026-55536CWE-284CWE-625broken-access-control

CVE-2026-55536

Critical · published August 25, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00521 · 43.4th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-625 · Permissive Regular Expression
Published
2026-08-25T20:16Z
References (4)
https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1 · [email protected]https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58 · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g6r-q6gw-w8fg · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g6r-q6gw-w8fg · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:36Z
    EPSS moved — → 0%
    epss
  • 25 AUG 15:21Z
    Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
    cvelistv5