CyberRota Analysis
AI-GeneratedThe vulnerability exists in PraisonAI versions prior to 4.6.58, where the create_auth_middleware() function improperly allows unauthenticated requests to the Recipe server, bypassing API key and JWT authentication. This flaw could enable unauthorized users to execute potentially harmful POST requests to the /v1/recipes/run endpoint, posing a significant security risk. Organizations using affected versions of PraisonAI should prioritize upgrading to version 4.6.58 to mitigate this high-severity issue.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled. This issue is fixed in version 4.6.58.