VulnSocial

CVE-2026-57127Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET and the corresponding recipe value are absent. Unauthenticated clients can then reach recipe execution, input, and output surfaces and may trigger connected tools despite the operator explicitly enabling authentication. This issue is fixed in 4.6.58.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306CWE-1188

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-14: 1Patch / Workaround · 2026-09-14: 109-14
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Severity Daily@severitydaily
    Patch

    PraisonAI's 16 new CVEs describe fixes that shipped in June. CVE-2026-57127's affected range stops at 4.6.48 while its own description says 4.6.58 — ten releases a scanner will call clear. https://severitydaily.com/praisonai-16-cves-june-fixes-cve-2026-57127-range-ten-releases-short/

    Post summary

    The post announces 16 new CVEs for PraisonAI that describe fixes shipped in June, noting a discrepancy in the affected version range for CVE-2026-57127.

    0000047
    24 followersView on X

Explore more

Back to dashboard