CVE-2026-55539

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58.

Summary

PraisonAI's async Jobs API (the FastAPI service in praisonai/jobs/) installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs (executed against the operator's configured LLM credentials), list every job in the shared store, read other jobs' results, cancel running jobs, and delete terminal jobs — with no token, cookie, session, or per-job ownership value.

The server's default bind is 127.0.0.1, so remote reach requires an operator to bind a public interface, container-publish, reverse-proxy, or tunnel the service. Once reachable, the primitive is fully pre-authenticated.

This is a distinct, still-unpatched sibling of CVE-2026-44338. That CVE (GHSA-6rmh-7xcm-cpxj, fixed in 4.6.34) covered only the legacy Flask server src/praisonai/api_server.py. The fix added AUTH_ENABLED/AUTH_TOKEN/check_auth() to that file and did not touch the FastAPI jobs module. At the latest commit (9fcac3a, version 4.6.51) the legacy Flask server is patched but the jobs API remains completely unauthenticated.

Technical Detail

Source-to-sink trace

The FastAPI app includes the jobs router with only CORS middleware — no auth (server.py, create_app):

# src/praisonai/praisonai/jobs/server.py
def create_app(store=None, executor=None, cors_origins=None) -> FastAPI:
    app = FastAPI(title="PraisonAI Jobs API", ...)
    # ... CORS middleware only (allow_headers includes "Authorization",
    #     but CORS is not authentication) ...
    jobs_router = create_router(get_store(), get_executor())
    app.include_router(jobs_router)        # no dependencies=[Depends(...)]

The router (built inside create_router()) registers every job operation with no auth dependency. The only Header(...) parameter anywhere is the Idempotency-Key, which is deduplication, not authorization:

# src/praisonai/praisonai/jobs/router.py
router = APIRouter(prefix="/api/v1/runs", tags=["jobs"])
 
@router.post("",          status_code=202)  async def submit_job(request, response, body, idempotency_key=Header(None, alias="Idempotency-Key")): ...
@router.get("")                              async def list_jobs(status=None, session_id=None, page=1, page_size=20): ...
@router.get("/{job_id}")                     async def get_job_status(job_id): ...
@router.get("/{job_id}/result")              async def get_job_result(job_id): ...
@router.post("/{job_id}/cancel")             async def cancel_job(job_id): ...
@router.delete("/{job_id}", status_code=204) async def delete_job(job_id): ...
@router.get("/{job_id}/stream")              async def stream_job(job_id): ...

submit_job() builds a Job from attacker-controlled JSON and submits it. The executor saves and schedules it, and for the default praisonai framework runs the attacker prompt against a real agent:

# executor.py — submit() -> _execute_job() -> _run_agent() -> _run_praisonai_agents()
agent = Agent(instructions="You are a helpful AI assistant.", output="minimal")
result = await asyncio.to_thread(agent.start, job.prompt)   # attacker-controlled prompt

The in-memory store has no owner / principal / user concept. list_jobs() returns the whole store filtered only by caller-supplied status/session_id:

# store.py
async def list_jobs(self, status=None, session_id=None, limit=20, offset=0):
    jobs = list(self._jobs.values())        # global; no owner binding
    if session_id: jobs = [j for j in jobs if j.session_id == session_id]
    ...

A repository-wide grep of jobs/ for Depends|verify|token|authorization|bearer|x-api-key|HTTPBearer|AUTH_ENABLED|check_auth returns only the string "Authorization" inside the CORS allow_headers list. There is no authentication primitive in the module.

Distinction from CVE-2026-44338 (critical for triage)

| |…

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58.

Summary

PraisonAI's async Jobs API (the FastAPI service in praisonai/jobs/) installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs (executed against the operator's configured LLM credentials), list every job in the shared store, read other jobs' results, cancel running jobs, and delete terminal jobs — with no token, cookie, session, or per-job ownership value.

The server's default bind is 127.0.0.1, so remote reach requires an operator to bind a public interface, container-publish, reverse-proxy, or tunnel the service. Once reachable, the primitive is fully pre-authenticated.

This is a distinct, still-unpatched sibling of CVE-2026-44338. That CVE (GHSA-6rmh-7xcm-cpxj, fixed in 4.6.34) covered only the legacy Flask server src/praisonai/api_server.py. The fix added AUTH_ENABLED/AUTH_TOKEN/check_auth() to that file and did not touch the FastAPI jobs module. At the latest commit (9fcac3a, version 4.6.51) the legacy Flask server is patched but the jobs API remains completely unauthenticated.

Technical Detail

Source-to-sink trace

The FastAPI app includes the jobs router with only CORS middleware — no auth (server.py, create_app):

# src/praisonai/praisonai/jobs/server.py
def create_app(store=None, executor=None, cors_origins=None) -> FastAPI:
    app = FastAPI(title="PraisonAI Jobs API", ...)
    # ... CORS middleware only (allow_headers includes "Authorization",
    #     but CORS is not authentication) ...
    jobs_router = create_router(get_store(), get_executor())
    app.include_router(jobs_router)        # no dependencies=[Depends(...)]

The router (built inside create_router()) registers every job operation with no auth dependency. The only Header(...) parameter anywhere is the Idempotency-Key, which is deduplication, not authorization:

# src/praisonai/praisonai/jobs/router.py
router = APIRouter(prefix="/api/v1/runs", tags=["jobs"])
 
@router.post("",          status_code=202)  async def submit_job(request, response, body, idempotency_key=Header(None, alias="Idempotency-Key")): ...
@router.get("")                              async def list_jobs(status=None, session_id=None, page=1, page_size=20): ...
@router.get("/{job_id}")                     async def get_job_status(job_id): ...
@router.get("/{job_id}/result")              async def get_job_result(job_id): ...
@router.post("/{job_id}/cancel")             async def cancel_job(job_id): ...
@router.delete("/{job_id}", status_code=204) async def delete_job(job_id): ...
@router.get("/{job_id}/stream")              async def stream_job(job_id): ...

submit_job() builds a Job from attacker-controlled JSON and submits it. The executor saves and schedules it, and for the default praisonai framework runs the attacker prompt against a real agent:

# executor.py — submit() -> _execute_job() -> _run_agent() -> _run_praisonai_agents()
agent = Agent(instructions="You are a helpful AI assistant.", output="minimal")
result = await asyncio.to_thread(agent.start, job.prompt)   # attacker-controlled prompt

The in-memory store has no owner / principal / user concept. list_jobs() returns the whole store filtered only by caller-supplied status/session_id:

# store.py
async def list_jobs(self, status=None, session_id=None, limit=20, offset=0):
    jobs = list(self._jobs.values())        # global; no owner binding
    if session_id: jobs = [j for j in jobs if j.session_id == session_id]
    ...

A repository-wide grep of jobs/ for Depends|verify|token|authorization|bearer|x-api-key|HTTPBearer|AUTH_ENABLED|check_auth returns only the string "Authorization" inside the CORS allow_headers list. There is no authentication primitive in the module.

Distinction from CVE-2026-44338 (critical for triage)

| |…

Summary

PraisonAI's async Jobs API (the FastAPI service in praisonai/jobs/) installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs (executed against the operator's configured LLM credentials), list every job in the shared store, read other jobs' results, cancel running jobs, and delete terminal jobs — with no token, cookie, session, or per-job ownership value.

The server's default bind is 127.0.0.1, so remote reach requires an operator to bind a public interface, container-publish, reverse-proxy, or tunnel the service. Once reachable, the primitive is fully pre-authenticated.

This is a distinct, still-unpatched sibling of CVE-2026-44338. That CVE (GHSA-6rmh-7xcm-cpxj, fixed in 4.6.34) covered only the legacy Flask server src/praisonai/api_server.py. The fix added AUTH_ENABLED/AUTH_TOKEN/check_auth() to that file and did not touch the FastAPI jobs module. At the latest commit (9fcac3a, version 4.6.51) the legacy Flask server is patched but the jobs API remains completely unauthenticated.

Technical Detail

Source-to-sink trace

The FastAPI app includes the jobs router with only CORS middleware — no auth (server.py, create_app):

# src/praisonai/praisonai/jobs/server.py
def create_app(store=None, executor=None, cors_origins=None) -> FastAPI:
    app = FastAPI(title="PraisonAI Jobs API", ...)
    # ... CORS middleware only (allow_headers includes "Authorization",
    #     but CORS is not authentication) ...
    jobs_router = create_router(get_store(), get_executor())
    app.include_router(jobs_router)        # no dependencies=[Depends(...)]

The router (built inside create_router()) registers every job operation with no auth dependency. The only Header(...) parameter anywhere is the Idempotency-Key, which is deduplication, not authorization:

# src/praisonai/praisonai/jobs/router.py
router = APIRouter(prefix="/api/v1/runs", tags=["jobs"])
 
@router.post("",          status_code=202)  async def submit_job(request, response, body, idempotency_key=Header(None, alias="Idempotency-Key")): ...
@router.get("")                              async def list_jobs(status=None, session_id=None, page=1, page_size=20): ...
@router.get("/{job_id}")                     async def get_job_status(job_id): ...
@router.get("/{job_id}/result")              async def get_job_result(job_id): ...
@router.post("/{job_id}/cancel")             async def cancel_job(job_id): ...
@router.delete("/{job_id}", status_code=204) async def delete_job(job_id): ...
@router.get("/{job_id}/stream")              async def stream_job(job_id): ...

submit_job() builds a Job from attacker-controlled JSON and submits it. The executor saves and schedules it, and for the default praisonai framework runs the attacker prompt against a real agent:

# executor.py — submit() -> _execute_job() -> _run_agent() -> _run_praisonai_agents()
agent = Agent(instructions="You are a helpful AI assistant.", output="minimal")
result = await asyncio.to_thread(agent.start, job.prompt)   # attacker-controlled prompt

The in-memory store has no owner / principal / user concept. list_jobs() returns the whole store filtered only by caller-supplied status/session_id:

# store.py
async def list_jobs(self, status=None, session_id=None, limit=20, offset=0):
    jobs = list(self._jobs.values())        # global; no owner binding
    if session_id: jobs = [j for j in jobs if j.session_id == session_id]
    ...

A repository-wide grep of jobs/ for Depends|verify|token|authorization|bearer|x-api-key|HTTPBearer|AUTH_ENABLED|check_auth returns only the string "Authorization" inside the CORS allow_headers list. There is no authentication primitive in the module.

Distinction from CVE-2026-44338 (critical for triage)

| |…