GHSA-86qc-r5v2-v6x6: PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
SummaryPraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured.The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents.This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane.DetailsThe vulnerable behavior is caused by a fail-open authentication default.In `praisonai/api/agent_invoke.py`, `CALL_SERVER_TOKEN` is read from the environment:The authentication dependency then returns successfully when the token is not configured:This means that the absence of `CALL_SERVER_TOKEN` disables authentication entirely.The same helper is used by sensitive agent-control routes, including:These endpoints allow a caller to:list registered agents;retrieve agent metadata;retrieve agent instruction text;invoke agents;unregister agents.The vulnerable router is mounted by the call server:The call server then listens on all interfaces:Therefore, when `praisonai-call` is started without `CALL_SERVER_TOKEN`, the agent-control API becomes reachable without authentication from any client that can access the server.PoCThe following local PoC imports the real `praisonai.api.agent_invoke` router from source, ensures `CALL_SERVER_TOKEN` is absent, registers a demo agent, mounts the router into a local FastAPI app, and sends unauthenticated requests to the vulnerable endpoints.The PoC proves that, without sending any authentication material:`GET /api/v1/agents` returns the list of registered agents.`GET /api/v1/agents/{agent_id}` exposes agent metadata and instructions.`POST /api/v1/agents/{agent_id}/invoke` executes the registered agent.`DELETE /api/v1/agents/{agent_id}` unregisters the agent.Run with:Full PoC:Observed result:This confirms that the agent-control endpoints are accessible without authentication when `CALL_SERVER_TOKEN` is unset.ImpactIf an operator runs the PraisonAI call server without explicitly setting `CALL_SERVER_TOKEN`, any reachable client may be able to:enumerate registered agents;read agent metadata;read agent instruction text;invoke agents;trigger downstream tools or external integrations connected to agents;consume model or API budget through repeated invocation;unregister agents and disrupt availability.The impact depends on the deployed agents and their connected tools. For agents wired to external APIs, internal systems, local tools, or privileged actions, this creates a remote unauthenticated control surface.The issue is not limited to information disclosure. The unauthenticated `invoke` endpoint can trigger agent execution, and the unauthenticated `delete` endpoint can remove registered agents.Suggested remediationRecommended fixes:Fail closed when `CALL_SERVER_TOKEN` is unset.The authentication dependency should reject requests unless authentication is explicitly configured and a valid token is supplied.Refuse to mount the agent invocation router unless authentication is configured.If unauthenticated mode is intended for local development, bind to `127.0.0.1` by default when `CALL_SERVER_TOKEN` is absent.Add a startup error or highly visible warning when the call server is started without authentication.Add regression tests that assert `401 Unauthorized` for all sensitive agent routes when no valid token is supplied.Consider requiring an explicit unsafe flag, such as `--allow-unauthenticated-call-server`, before allowing the server to start without authentication.Security boundaryThis report concerns the default authentication behavior of a network-facing server component. The issue is not that users can intentionally disable authentication for trusted local development. The issue is that the server fails open when `CALL_SERVER_TOKEN` is missing while the bundled server binds to `0.0.0.0`, which can expose the agent-control API remotely.
CVSS v3.1: 9.8