CVE-2026-57134CWE-287CWE-288CWE-863broken-access-control

CVE-2026-57134

High · published September 15, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00414 · 34.6th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-288 · Authentication Bypass Using an Alternate Path or Channel; CWE-863 · Incorrect Authorization
Published
2026-09-15T15:17Z
References (4)
https://github.com/MervinPraison/PraisonAI/commit/709a0387853709a5e2f2c34680fa64cada252c27 · [email protected]https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.60 · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4qq2-2j2x-x62c · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4qq2-2j2x-x62c · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:31Z
    EPSS moved — → 0%
    epss
  • 15 SEP 10:23Z
    PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
    cvelistv5