Summary
CVE-2026-55539 is a missing authentication vulnerability (CWE-306) in PraisonAI, an open-source multi-agent teams framework. The framework’s asynchronous Jobs API endpoint (/api/v1/runs) is mounted without any authentication mechanism, allowing any network-reachable caller to submit jobs, read job results, cancel running operations, or delete jobs using the operator’s own LLM credentials. The issue carries a CVSS v3.1 base score of 8.6 (High) and is fixed in PraisonAI 4.6.58.
Technical details
- Root cause: The
create_appfunction in thepraisonai/jobs/module mounts the/api/v1/runsFastAPI router with no authentication middleware, no router-level dependency, and no per-route auth check — requests are accepted without any token, cookie, session identifier, or ownership validation. - Trigger conditions: The Jobs API server must be network-reachable by the attacker. It defaults to binding on
127.0.0.1, but exposure occurs when the service is bound publicly, run in a container, or placed behind a reverse proxy that forwards external traffic to it. - Attack vector: Network (AV:N) — no privileges and no user interaction are required (PR:N/UI:N).
- Impact: An unauthenticated attacker can submit and execute arbitrary jobs against the operator’s LLM credentials, enumerate all jobs in the shared store, read other users’ job results, cancel in-progress operations, and delete completed jobs — resulting in low confidentiality and integrity impact and high availability impact (C:L/I:L/A:H).
- Scope note: This is distinct from the earlier, related PraisonAI authentication issue (CVE-2026-44338), which only addressed the legacy Flask server; this flaw exists specifically in the newer FastAPI-based Jobs module and was not covered by that prior fix.
Affected software
- PraisonAI (
praisonaiPyPI package), versions prior to 4.6.51 through builds up to 4.6.57 (i.e., all versions < 4.6.58)
Severity
- CVSS v3.1 Base Score: 8.6 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Mitigation and recommended actions
- Immediate: Upgrade PraisonAI to version 4.6.58 or later, which introduces a
PRAISONAI_JOBS_API_KEYauthentication middleware requiring a validAuthorizationorX-API-Keyheader on Jobs API requests. - If immediate patching is not possible:
- Ensure the Jobs API service is bound only to
127.0.0.1/localhost and is never exposed via public network interfaces, container port mappings, or reverse proxies without an authenticating gateway in front of it. - Restrict network access to the Jobs API port using firewall rules or network segmentation, allowing only trusted internal callers.
- Audit job history and stored results for evidence of unauthorized submissions, cancellations, or deletions if the service has been externally reachable.
- Ensure the Jobs API service is bound only to

