Live › vulnerability › CVE-2026-56836
Go to dashboardPraisonAI's installed console entrypoint can start the Recipe HTTP server on a non-localhost interface with no authentication. Unauthenticated requests can reach the recipe API and, when enabled, the /admin/reload endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running PraisonAI from up to who start the recipe server through on a network-reachable interface. Hosts that keep the server on localhost or run only the library without the recipe server are not described as exposed by the sources.
4.5.1124.6.59praisonai recipe serveNo product ranges from the sources yet.
praisonai --version or pip show praisonai; versions from 4.5.112 up to but not including 4.6.59 are affected.praisonai recipe serve in startup scripts or service definitions bound to a non-localhost host.4.6.59 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.
This page as .md · .json · in your agent: get_signal("CVE-2026-56836")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.