What happened
NVD published five independent CVSS 9.8 CRITICAL CVEs against PraisonAI on 2026-09-14, all rooted in authentication/authorization being either absent by default or silently bypassable, across the MCP tools server, the UI's MCP-connect endpoint, the Jobs API, the recipe-serve auth middleware, and the jobs router. All are remotely exploitable with no privileges and no user interaction.
Why it matters
PraisonAI is an agent orchestration framework whose entire value proposition is executing LLM-directed tool calls, shell commands, and code. A single unauthenticated POST can command a deployed multi-agent instance to run arbitrary OS commands, spawn arbitrary local processes, or hijack registered tool servers — full compromise of any internet-reachable default-configured deployment, with no credentials required.
Attack vector
PraisonAI, a multi-agent teams system, shipped at least five CVSS 9.8 unauthenticated-access flaws disclosed the same day: (1) CVE-2026-57123 — ToolsMCPServer.run_sse/launch_tools_mcp_server bind to 0.0.0.0 without invoking SecurityConfig auth/origin/DNS-rebinding checks, letting any reachable client list and invoke registered file/shell/code-exec tools; (2) CVE-2026-57124 — unauthenticated POST /api/mcp/connect lets a remote caller start arbitrary local processes via StdioMCPClient; (3) CVE-2026-57125 — unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml and an 'approve' field that pre-approves execute_command before @require_approval checks, letting a remote caller trigger arbitrary OS command execution with no credentials; (4) CVE-2026-57127 — API-key/JWT auth middleware forwards requests when the configured secret env var is unset, silently disabling auth; (5) CVE-2026-57131 — Jobs router mounted under /api/v1/runs with no authentication/authorization at all, exposing job submission, listing, and cancellation to any network client.
Affected systems
PraisonAI / praisonaiagents < 4.6.59 (praisonaiagents < 1.6.59); praisonai.jobs server < 4.6.58; recipe-serve auth middleware < 4.6.58
Mitigation
Upgrade to praisonai 4.6.59 / praisonaiagents 1.6.59 (or 4.6.58 for the recipe-serve/jobs-router issues); all fixes are in the MervinPraison/PraisonAI GitHub releases referenced by each GHSA. Do not expose any PraisonAI HTTP surface (UI, MCP tools server, Jobs API, recipe serve) to an untrusted network without verifying the auth middleware is actually enforced post-patch.