{"id":"CVE-2026-57132","aliases":["GHSA-8ccj-p46r-jwqq","PYSEC-2026-3508"],"url":"https://o3.security/vulnerability/CVE-2026-57132","summary":"PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication","details":"PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.6.62.","published":"2026-09-14T15:09:19.782Z","modified":"2026-09-15T03:48:18.127734993Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"praisonai","fixedVersion":"4.6.61"}],"fix":{"url":"https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33","label":"MervinPraison/PraisonAI@2a855c4"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57132.json"},{"type":"FIX","url":"https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33"},{"type":"WEB","url":"https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62"},{"type":"ADVISORY","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8ccj-p46r-jwqq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57132"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-15T03:48:18.127734993Z"}}