CVE-2026-55533

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58

Description The Recipe HTTP server in PraisonAI contains an authentication fail-open condition. When authentication is configured as api-key or jwt, the server silently allows unauthenticated requests if the corresponding PRAISONAI API KEY or PRAISONAI JWT SECRET environment variables (or configuration secrets) are missing. This occurs within the create auth middleware() function, which permits requests to proceed if no secret is found, even when authentication is explicitly enabled. This is particularly critical for servers bound to non-localhost interfaces, as the CLI safety check only verifies that authentication is not set to none, without confirming that a secret actually exists.

Affected API endpoints include:

Recommendations Update PraisonAI to version 4.6.58. As a temporary mitigation, ensure that PRAISONAI API KEY or PRAISONAI JWT SECRET are explicitly configured when using api-key or jwt authentication, or restrict the server binding to 127.0.0.1 to prevent external access.