Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-57131

praisonai: Jobs API exposes agent-execution endpoints with no authentication

CVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-57131

Published

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. This vulnerability is fixed in 4.6.58.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-57131

Published

PraisonAI

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "MervinPraison",
                    "product": "PraisonAI",
                    "versions": [
                        {
                            "version": "< 4.6.48",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON