PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
Date: 2026-06
Affected: pip/praisonaiagents, pip/praisonai
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-306
CWE-863
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

# Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI ## Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the `/api/v1/runs` endpoint requires no credentials, and a top-level `approve` field in the submitted YAML unconditionally bypasses the `@require_approval` safety decorator on dangerous tools such as `execute_command`. **Ecosystem:** pip | **Package:** `praisonai` | **Affected:** `<= 4.6.48` | **Patched:** *(none)* --- ## Details ### Step 1 — No authentication on the Jobs API `POST /api/v1/runs` accepts and executes agent jobs from any caller with no token or session required: ```python # src/praisonai/praisonai/jobs/router.py:47 @router.post("", response_model=JobSubmitResponse, status_code=202) async def submit_job( request: Request, body: JobSubmitRequest, # accepts agent_yaml from anyone ... # missing: _: None = Depends(verify_token) ): ``` Compare with the authenticated endpoint in `api/agent_invoke.py`, which correctly includes `Depends(verify_token)`. ### Step 2 — `approve` YAML field bypasses `@require_approval` The YAML parser extracts an attacker-controlled `approve` list and loads it into a ContextVar that the approval decorator consults before every tool call: ```python # src/praisonai-agents/praisonaiagents/workflows/yaml_parser.py:261 approve_tools


Mitigations:

Architectural layers (MAESTRO):