High severity8.2NVD Advisory· Published Sep 15, 2026· Updated Sep 15, 2026
CVE-2026-57134
CVE-2026-57134
Description
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
praisonainpm | >= 1.5.1, < 1.7.2 | 1.7.2 |
Affected products
1Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.