VYPR
Vypr IntelligenceAI-generatedSep 15, 2026· 21 CVEs

PraisonAI: 21 Critical Vulnerabilities Disclosed in Batch Affecting Authentication and Code Execution

PraisonAI platform faces 21 disclosed vulnerabilities, including Critical flaws in authentication, code execution, and data handling, impacting multiple versions.

Key findings

  • 21 vulnerabilities disclosed for PraisonAI between Sep 14-15, 2026, with multiple Critical (CVSS 9.8) ratings.
  • Flaws include authentication bypasses, arbitrary code execution, and path traversal vulnerabilities across core components.
  • Affected versions range from 0.1.6 to 4.6.62 and 1.6.59; users must update promptly.
  • Critical issues in auth services, job APIs, and agent execution allow unauthenticated access and sensitive data exposure.
  • Insecure handling of user input and network requests exposes systems to command injection and unauthorized access.

On September 14-15, 2026, a significant batch of 21 vulnerabilities was disclosed for the PraisonAI multi-agent teams system. These vulnerabilities, ranging in severity from Medium to Critical, with several rated at CVSSv3 9.8, expose the system to various risks including unauthenticated access, arbitrary code execution, and sensitive data exposure. The disclosures highlight critical flaws in authentication, authorization, and input validation across multiple components of the PraisonAI platform.

Several vulnerabilities stem from improper handling of authentication mechanisms. CVE-2026-57148 and CVE-2026-57147 detail how the system falls back to a default, insecure JWT signing key when secrets are unset, disabling crucial security guards and allowing unauthenticated access. Similarly, CVE-2026-57131 and CVE-2026-57127 indicate that the Jobs API and authentication middleware can be bypassed if specific environment variables or secrets are absent, respectively, leading to unauthenticated job submission and API access. CVE-2026-57132 also highlights an authentication bypass for agent invocation when a specific configuration option is disabled.

Other critical issues involve insecure handling of user-provided input and code execution. CVE-2026-57138 describes a critical flaw where untrusted JavaScript is executed with elevated privileges due to insufficient blocklisting and reliance on shadowed properties. CVE-2026-57133 points to a vulnerability where a restricted command list is bypassed because only the first token of a command string is checked, allowing arbitrary commands to be executed via child_process.exec(). CVE-2026-57145 and CVE-2026-57129 highlight path traversal vulnerabilities in file handling, allowing agents to read or write to arbitrary files outside their intended scope. CVE-2026-57119 also involves path traversal in the Jobs API, enabling access to files outside the workspace.

The batch also includes vulnerabilities related to network service exposure and insecure communication. CVE-2026-57139 details how a server component binds to all interfaces without host restrictions and forwards requests without authentication, allowing any network client to interact with it. CVE-2026-57124 and CVE-2026-57123 describe unauthenticated endpoints in the default UI and agent server that accept caller-controlled arguments, leading to local process execution and unauthorized access to system functions. CVE-2026-57126 and CVE-2026-57115 reveal issues with URL validation, where redirects to sensitive internal or loopback addresses are not properly re-validated, potentially exposing internal services. CVE-2026-57130 describes an injection vulnerability in email search criteria, allowing for manipulation of IMAP queries.

The affected versions span a wide range, with fixes generally available in versions 0.1.6, 4.6.58, 4.6.59, 4.6.62, and 1.6.59 for praisonaiagents, depending on the specific component. Users are strongly advised to update to the patched versions to mitigate these critical security risks. The coordinated disclosure of these numerous vulnerabilities underscores the importance of rigorous security auditing and timely patching for complex AI systems like PraisonAI.

This extensive set of vulnerabilities, disclosed within a 20-hour window, indicates a systemic security weakness that could be exploited by attackers to gain unauthorized access, execute arbitrary code, and compromise sensitive data within PraisonAI deployments. Prompt patching and a thorough review of security configurations are essential for all users of the PraisonAI platform.

Key versions mentioned include:

  • PraisonAI platform: Prior to 0.1.6
  • PraisonAI: Prior to 4.6.58, 4.6.59, 4.6.62
  • Praisonaiagents: Prior to 1.6.58, 1.6.59

Specific fixes are noted for versions such as 0.1.6, 4.6.58, 4.6.59, 4.6.62, and 1.6.59.

The vulnerabilities can be broadly categorized by their impact:

Users are urged to consult the official PraisonAI advisories and update their systems immediately.

CVE-2026-57148, CVE-2026-57147, CVE-2026-57139, CVE-2026-57138, CVE-2026-57133, CVE-2026-57112, CVE-2026-57145, CVE-2026-57132, CVE-2026-57131, CVE-2026-57127, CVE-2026-57124, CVE-2026-57122, CVE-2026-57119, CVE-2026-57130, CVE-2026-57129, CVE-2026-57128, CVE-2026-57126, CVE-2026-57125, CVE-2026-57123, CVE-2026-57120, CVE-2026-57115.

AI-written article. Grounded in 21 CVE records listed below.