SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-55539

HIGH · CVSS 8.6 EPSS 0.39% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-25 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The Jobs API in PraisonAI versions prior to 4.6.51 is vulnerable due to a lack of authentication, allowing unauthorized users to submit jobs, access results, cancel runs, or delete jobs with operator credentials. This high-severity vulnerability could lead to significant data manipulation and operational disruptions. Organizations using PraisonAI should prioritize upgrading to version 4.6.58 or later to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-55539
Severity
HIGH
CVSS
8.6
EPSS
0.39%

Original NVD Description

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58.