CVE-2026-55533: PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT…

PriorityP357high8.2CVSS 3.1

AVNACLPRNUINSUCLIHAN

EPSS

0.34%

27.3th percentile

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled. This issue is fixed in version 4.6.58.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mervinpraison	praisonai	< 4.6.58	4.6.58
mervinpraison	praisonai	>= 0 < 4.6.58	4.6.58

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.