VulnSocial

CVE-2026-57131Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool capabilities to unauthorized agent execution. This vulnerability is fixed in 4.6.58.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94CWE-306CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-14: 1Patch / Workaround · 2026-09-14: 1Technical Details · 2026-09-14: 109-14
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 PraisonAI'de CVSS 9.8 kritik güvenlik açığı! CVE-2026-57131 kapsamında PraisonAI'nin Jobs API'sinde kimlik doğrulama ve job bazlı yetkilendirme eksikliği tespit edildi. Saldırganlar kimlik doğrulaması olmadan /api/v1/runs üzerinden kontrol ettikleri prompt ve agent yapılandırmalarını gönderebilir, job'ları okuyabilir, sonuçları izleyebilir ve diğer job'ları iptal/silebilir. Açık, yetkisiz agent çalıştırma yoluyla servis kimlik bilgileri ve bağlı araçların kötüye kullanılmasına yol açabiliyor. CVSS: 9.8 Critical Etkilenen: 4.6.58 öncesi Çözüm: 4.6.58 ve sonrası https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fq2m-6wqh-x44g

    Post summary

    The text discloses a critical PraisonAI vulnerability, CVE-2026-57131, with technical details and CVSS 9.8 severity. Its primary actionable takeaway is the availability of a fixed version, with version 4.6.58 and later listed as the solution.

    00021449
    2.5K followersView on X

Explore more

Back to dashboard