{"id":"CVE-2026-56836","kind":"vulnerability","aliases":["CVE-2026-56836"],"related":[],"title":"PraisonAI: recipe server runs unauthenticated on network interfaces","description":"PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.","summary":"PraisonAI's installed console entrypoint can start the Recipe HTTP server on a non-localhost interface with no authentication. Unauthenticated requests can reach the recipe API and, when enabled, the /admin/reload endpoint.","severity":"high","cvss":8.2,"epss":0.00395,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","praisonai","python","self-hosted"],"not_affected_if":["localhost-only-binding","upgraded-to-4.6.59"],"how_to_check":"- Check the installed version with `praisonai --version` or `pip show praisonai`; versions from `4.5.112` up to but not including `4.6.59` are affected.\n- Look for `praisonai recipe serve` in startup scripts or service definitions bound to a non-localhost host.","fix":"- Upgrade PraisonAI to `4.6.59` or later.","status":"open","published_at":"2026-10-23T12:18:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T03:03:38+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:03:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PraisonAI to `4.6.59` or later.","reach":"network","title":"PraisonAI: recipe server runs unauthenticated on network interfaces","impact":"medium","summary":"PraisonAI's installed console entrypoint can start the Recipe HTTP server on a non-localhost interface with no authentication. Unauthenticated requests can reach the recipe API and, when enabled, the /admin/reload endpoint.","category":"ai-tooling","nicknames":[],"who_cares":["python","praisonai","ai-agents","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated remote users reach recipe API and admin reload endpoint","analyst_note":"Confirm from the NVD or upstream advisory which endpoints the recipe API exposes and whether /admin/reload enables code execution or only reloads configuration.","how_to_check":"- Check the installed version with `praisonai --version` or `pip show praisonai`; versions from `4.5.112` up to but not including `4.6.59` are affected.\n- Look for `praisonai recipe serve` in startup scripts or service definitions bound to a non-localhost host.","needs_analyst":true,"not_affected_if":["localhost-only-binding","upgraded-to-4.6.59"],"who_is_affected":"Teams running PraisonAI from `4.5.112` up to `4.6.59` who start the recipe server through `praisonai recipe serve` on a network-reachable interface. Hosts that keep the server on localhost or run only the library without the recipe server are not described as exposed by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":3449,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-56836':11A,14A '/admin/reload':57B,162C '4.5.112':69C '4.6.59':73C,170C 'absent':138C 'agent':17B,64C 'ai':16B,19B 'ai-ag':15B 'ai-tool':18B 'api':52B,146C,158C 'api-key':145C 'app':94C,140C 'attach':143C 'authent':45B,124C 'command':88C,104C,109C 'config.auth':136C 'consol':29B,77C 'creat':139C 'current':84C 'cve':9A,12A 'deprec':102C,128C 'dispatch':99C 'enabl':55B,161C 'endpoint':58B 'entrypoint':30B,78C 'first':82C 'host':25B 'http':35B,114C 'instal':28B,76C 'interfac':8A,42B,121C 'issu':164C 'jwt':149C 'key':147C 'launch':132C 'localhost':41B,120C 'middlewar':150C 'multi':63C 'multi-ag':62C 'network':7A 'non':40B,119C 'non-localhost':39B,118C 'patch':167C 'praisonai':1A,21B,26B,59C,74C,96C 'print':126C 'python':22B 'reach':49B,155C 'recip':2A,34B,51B,87C,97C,113C,157C 'regist':90C 'releas':85C 'request':47B,152C 'run':4A 'self':24B 'self-host':23B 'serv':98C 'server':3A,36B,115C,134C 'src/praisonai/praisonai/cli/commands/recipe.py':106C 'start':32B,111C 'system':66C 'team':65C 'tool':20B 'typer':81C,93C,103C,108C 'typer-first':80C 'unauthent':5A,46B,151C 'version':68C,72C,169C 'warn':129C","nicknames":[],"mitigations":[],"who_affected":"Teams running PraisonAI from `4.5.112` up to `4.6.59` who start the recipe server through `praisonai recipe serve` on a network-reachable interface. Hosts that keep the server on localhost or run only the library without the recipe server are not described as exposed by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56836","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56836","severity":null,"published_at":"2026-10-23T12:18:15+00:00","modified_at":"2026-10-23T12:18:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-56836","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56836","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}