PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
Date: 2026-06
Affected: pip/praisonai
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-306
CWE-862
CWE-94
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

# praisonai: Jobs API exposes agent-execution endpoints with no authentication **Researcher:** Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research **Target:** https://github.com/MervinPraison/PraisonAI --- **Package:** `praisonai` on PyPI **Affected version (empirically tested):** 4.6.48 **Components:** - `praisonai.jobs.server.create_app` — `praisonai/jobs/server.py` - `praisonai.jobs.router.create_router` — `praisonai/jobs/router.py` - Routes mounted at `/api/v1/runs/...` **Weakness:** CWE-306 Missing Authentication for Critical Function · CWE-862 Missing Authorization · CWE-94 Code Injection (via prompt / agent_yaml). --- ## TL;DR `praisonai` ships a standalone async-jobs HTTP server (`python -m praisonai.jobs.server --host=0.0.0.0 --port=8005`) whose job is to accept job submissions and run agents on the operator's behalf. Every endpoint under `/api/v1/runs` is **unauthenticated**. There is no `auth_token` field, no `Depends(verify_*)`, no middleware that inspects `Authorization` — the CORS middleware *lists* `Authorization` in `allow_headers` (the only signal in the whole module that the developer was aware authentication is a thing), but no route ever reads it. A network-reachable attacker can: 1. **Execute arbitrary agent code** — `POST /api/v1/runs` accepts `prompt`, `agent_yaml`, `agent_file`, `config`, `framework`. The job is queued and an executor invokes whichever framework (`praisonai` / `crewai` / `autogen`) the attacker p


Mitigations:

Architectural layers (MAESTRO):