High severity8.6NVD Advisory· Published Aug 25, 2026· Updated Sep 9, 2026

CVE-2026-55539

Description

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
PraisonAIPyPI	< 4.6.58	4.6.58

Affected products

PraisonAI/PraisonAIllm-fuzzy
Range: 4.6.51 - 4.6.57
Praison/Praisonaillm-create
Range: 4.6.51 - 4.6.57

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-2jgc-f764-c5r2ghsaADVISORY
github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1nvdWEB
github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58nvdWEB
github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2jgc-f764-c5r2nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000