VulnSocial

CVE-2026-57148Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET is unset, while the startup and token-issuance guards are disabled because PLATFORM_ENV also defaults to dev. An unauthenticated attacker can sign a JWT containing an attacker-chosen sub value, and AuthService._verify_token() accepts it as an authenticated identity, enabling user or workspace-owner impersonation when a target identifier is known. This vulnerability is fixed in praisonai-platform 0.1.6.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287CWE-798CWE-1188

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-16: 1Patch / Workaround · 2026-09-16: 1Technical Details · 2026-09-16: 109-16
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
Full discourse1 post
  • CCB Alert@CCBalert
    Patch

    Warning: Four critical #PraisonAI flaws allow unauthenticated #RCE, MCP tool abuse, and JWT auth bypass via a hardcoded secret. #CVE-2026-57141 #CVE-2026-57139 #CVE-2026-57147 #CVE-2026-57148 CVSS(3.1): 9.8. Read the advisory https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p69m-4f92-2v84 and #Patch #Patch #Patch

    Post summary

    The tweet warns of four critical PraisonAI CVEs (RCE, auth bypass) with technical details and CVSS 9.8, references a GitHub vendor advisory, and urges patching.

    00010359
    7.3K followersView on X

Explore more

Back to dashboard