CVE-2026-57131

PraisonAI, an open-source multi-agent LLM framework, exposes its job service API at /api/v1/runs without any authentication or per-job authorization in versions prior to 4.6.58 (CWE-306, CWE-862, CWE-94). Any network client who can reach the praisonai jobs server (praisonai.jobs.server.create_app) can submit arbitrary prompts and attacker-controlled agent configuration, list and read other users' jobs, stream their results, and cancel or delete them. Because agents execute with the server's configured credentials and tool connections, this effectively allows unauthorized command of the LLM agents and their attached tools, exposing service credentials, prompts, and outputs (CVSS 9.8). Anyone running a praisonai jobs service below 4.6.58 on a network reachable by untrusted parties is affected. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not on the CISA KEV list.

What to do: Upgrade PraisonAI to 4.6.58 or later, which fixes the missing authentication and authorization on /api/v1/runs. If immediate upgrade is not possible, stop the praisonai jobs server or restrict it to trusted networks (loopback or VPN) and place it behind an authenticating reverse proxy. Operators should audit job history for unexplained runs and rotate credentials for any tools or services the agents could access.