CVE-2026-61435 · GHSA-2gpf-2492-q9jh
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
- Risk score
- 70/100
- CVSS
- 8.2 v3.1
- Exploit chance (30 days)
- 0.7%
- Published
- 15 Jul 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agent_invoke.py) when PRAISONAI_CALL_AUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host from request.url.ho…
- Affected
- praisonai (pip) <= 4.6.77
- Fix
- Upgrade praisonai to 4.6.78 or later.
- Exploitation
- No known exploitation
Story map
At a glance
praisonai: Amber, patch this week. The AICoder UI component exposes write_to_file and execute_command tools to the LLM with no path validation and no command sanitization. An attacker can achieve arbitrary file write to any location on the filesystem (including /root/.ssh/authorized_keys, /etc/crontab) and arbitrary command execution through prompt inj…
The flaws
- CVE-2026-61435: PraisonAI: Call API localhost-only authentication bypass via spoofed Host header (CVSS 8.2 · EPSS 1%)
- CVE-2026-61445: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls (CVSS 9.9 · EPSS 1%)
- CVE-2026-61426: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure (CVSS 8.6 · EPSS 0%)
- CVE-2026-61434: PraisonAI: Shell command allowlist bypass via find -exec built-in action (CVSS 8.8 · EPSS 1%)
The fix
Upgrade praisonai: 4.6.78 or later on your release line
Who is exposed: praisonai (pip) <= 4.6.77
Where it stands
- Public proof of concept
Connects to
- Same weakness: Authentication bypass (CWE-287). 237 other warnings in 30 days
Why it is Amber
- CVSS 8.2 high
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| praisonai | pip | <= 4.6.77 | 4.6.78 |
References
- https://github.com/advisories/GHSA-2gpf-2492-q9jh
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2gpf-2492-q9jh
- https://nvd.nist.gov/vuln/detail/CVE-2026-61435
- https://nvd.nist.gov/vuln/detail/CVE-2026-62174
- https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33
- https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753
- https://www.vulncheck.com/advisories/praisonai-before-authentication-bypass-via-host-header-spoofing
- https://github.com/advisories/GHSA-2gpf-2492-q9jh
Original description
PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agent_invoke.py) when PRAISONAI_CALL_AUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host from request.url.hostname, which is taken from the client-controlled HTTP Host header. A remote, unauthenticated attacker who can reach the service over the network can send a spoofed 'Host: 127.0.0.1' header to bypass the localhost-only restriction and list (GET /api/v1/agents) and invoke (POST /api/v1/agents/{agent_id}/invoke) registered agents without authentication.
Last activity 8 Oct 2026. Patch Forecast updates every hour.