CVE-2026-47397

PraisonAI before version 4.6.58 has a flaw in create_auth_middleware() that allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled.

PraisonAI before version 4.6.58 has a flaw in MCP HTTP Stream _validate_origin that uses startswith, allowing attacker-controlled localhost.attacker.com origin to pass the allowlist. A webpage can send text/plain requests without preflight and invoke tools without an API key, including file writes.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. Missing or incorrect bearer and X-API-Key values still reach agent execution. This issue is fixed in version 4.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor._send_webhook() later performs a fresh lookup, allowing DNS changes to direct the request to an internal service. This issue is fixed in version 4.6.58.

PraisonAI before version 4.6.58 has a vulnerability in the MCP HTTP Stream handler where the mcp_post handler creates a new _sessions entry for every initialize request but does not call _cleanup_sessions or enforce a maximum. An unauthenticated attacker can exhaust memory.

PraisonAI before version 1.6.58 has a vulnerability in the ast_grep_rewrite function, which lacks the @require_approval decorator used by sibling mutation tools. With dry_run=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected authorization gate.

PraisonAI is a multi-agent system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the shell command allowlist by using find's built-in actions (-exec, -execdir, -delete). Attackers can execute unauthorized commands, read or delete files without triggering shell metacharacter filters.

A path traversal vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 in the FastContext feature. The FastContextAgent.execute_tool() function does not properly validate absolute paths or canonicalize relative paths, allowing reading, searching, and enumerating files outside the intended workspace directory.

PraisonAI before version 4.6.78 contains a path traversal vulnerability in the ContextGatherer component that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.