What happened
Between Aug 24-25, 2026, GitHub Security Advisories/NVD published a large cluster of CVEs (CVE-2026-55525 through CVE-2026-55541, CWE-287/306/346/352/22 etc., CVSS 6.1-9.1) against PraisonAI, all traceable to inconsistent or missing authorization enforcement across its many server-exposed surfaces (agent server, MCP HTTP stream, Jobs API, Recipe server, Browser Server, FileMemory, spider/web_crawl tools).
Why it matters
PraisonAI is a multi-agent orchestration framework meant to run tools and code on a user's behalf; this cluster shows that nearly every network-facing surface of the framework could be reached without valid credentials or could be tricked into SSRF/internal-network access, which is a severe blast radius for any team that has exposed a PraisonAI server beyond localhost.
Attack vector
A systemic pattern across the codebase: origin checks using unanchored regex or startswith() prefix matching (e.g. chrome-extension://[a-z0-9]{32} unanchored, or localhost.attacker.com passing a 'localhost' allowlist check), missing authentication middleware on serve/agents, serve/unified, and Jobs API routes despite --api-key being configured, webhook URL validation that fails open on DNS resolution errors (enabling SSRF/DNS-rebinding to 127.0.0.1 or 169.254.169.254), and os.path.abspath() (rather than realpath()) used for workspace-boundary checks, allowing symlink escape.
Affected systems
PraisonAI / praisonaiagents (multi-agent teams system) — various components prior to praisonai 4.6.58 / praisonaiagents 1.6.58
Mitigation
Upgrade to praisonai 4.6.58 and praisonaiagents 1.6.58, which add anchored origin validation, consistent auth middleware across all server modes, DNS-rebinding-safe webhook validation, and realpath()-based workspace boundary checks.