---
id: "CVE-2026-56836"
kind: "vulnerability"
aliases: ["CVE-2026-56836"]
title: "PraisonAI: recipe server runs unauthenticated on network interfaces"
severity: "high"
cvss: 8.2
epss: 0.00395
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "praisonai", "python", "self-hosted"]
not_affected_if: ["localhost-only-binding", "upgraded-to-4.6.59"]
published_at: "2026-10-23T12:18:15+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56836", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-56836", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# PraisonAI: recipe server runs unauthenticated on network interfaces

PraisonAI's installed console entrypoint can start the Recipe HTTP server on a non-localhost interface with no authentication. Unauthenticated requests can reach the recipe API and, when enabled, the /admin/reload endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `praisonai --version` or `pip show praisonai`; versions from `4.5.112` up to but not including `4.6.59` are affected.
- Look for `praisonai recipe serve` in startup scripts or service definitions bound to a non-localhost host.

## Fix

- Upgrade PraisonAI to `4.6.59` or later.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56836
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-56836

## From the sources

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_