CVE-2026-57125

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

State: Published
Severity: 9.8 Critical
Published: Sep 14, 2026
Updated: Sep 14, 2026
Reserved: Jun 24, 2026

Description

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating-system commands without credentials or operator interaction. This vulnerability is fixed in praisonai 4.6.59 and praisonaiagents 1.6.59 as fixed versions.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-306 Missing Authentication for Critical Function
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
PraisonAIMervinPraison	< 4.6.59Affected
praisonaiagentsMervinPraison	< 1.6.59Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.