CVE-2026-57132

Name of the Vulnerable Software and Affected Versions PraisonAI (affected versions not specified)

Description Setting the PRAISONAI CALL AUTH variable to disabled completely bypasses all authentication for the /api/v1/agents/{id}/invoke endpoint. This occurs because the verify token() function returns immediately without performing any checks when this configuration is active. This bypass is suggested within the application's own error messages, increasing the likelihood of it being used in production Docker and Compose configurations. Consequently, any agent registered on the server can be triggered without credentials, potentially allowing the execution of arbitrary actions based on the tools configured for the agent.

Recommendations Avoid setting the PRAISONAI CALL AUTH variable to disabled in production environments. Ensure that authentication is enabled by configuring a valid CALL SERVER TOKEN. At the moment, there is no information about a newer version that contains a fix for this vulnerability.