CVE-2026-56836— PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI 是一个多智能体团队系统。在从版本 4.5.112 到 4.6.59（不含）的版本区间内，PraisonAI 安装的命令行入口点以 Typer 框架为首选。在当前版本中， 命令已注册到 Typer 应用中，而 会分发到位于 的已弃用 Typer 命令。该 Typer 命令能够在非本地接口（non-localhost）上启动 Recipe HTTP 服务器，且无需任何身份验证。执行时，系统会先打印一条弃用警告，随后启动服务器。由于配置中缺少 项， 函数不会附加 API 密钥或 JWT 中间件。因此，
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1078 · Valid Accounts T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.5.112, < 4.6.59 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-56836
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.5.112, < 4.6.59 | - |
|
II. Public POCs for CVE-2026-56836
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56836
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56836 (1)
Same Patch Batch · MervinPraison · 2026-10-23 · 16 CVEs total
| CVE-2026-57116 | 9.8 CRITICAL | PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remo |
| CVE-2026-56832 | 8.8 HIGH | PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals |
| CVE-2026-56840 | 8.8 HIGH | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-pa |
| CVE-2026-57117 | 8.8 HIGH | PraisonAI: Compute-bridged file tools allow shell command injection |
| CVE-2026-57144 | 8.8 HIGH | PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is |
| CVE-2026-56837 | 8.6 HIGH | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing |
| CVE-2026-56835 | 8.3 HIGH | PraisonAI Slack app_mention bypasses configured user/channel authorization |
| CVE-2026-57113 | 8.1 HIGH | PraisonAI GitHub template cache path traversal allows outside-cache file write and directo |
| CVE-2026-57121 | 8.1 HIGH | PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' co |
| CVE-2026-56838 | 7.8 HIGH | PraisonAI recipe.run_stream skips dangerous-tool policy enforcement |
| CVE-2026-57142 | 7.8 HIGH | PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous |
| CVE-2026-56833 | 7.5 HIGH | PraisonAI Dynamic Context history and terminal tools read files outside configured storage |
| CVE-2026-56834 | 7.5 HIGH | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storag |
| CVE-2026-57146 | 7.5 HIGH | PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated b |
| CVE-2026-57114 | 7.2 HIGH | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding |
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow
Same vendor: MervinPraison
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow
Same weakness: CWE-287
-
CVE-2026-55459
Goobi viewer: OpenID JWT audience not enforced by the verifi -
CVE-2026-55457
Goobi viewer: Empty webapi.authorization.token default permi -
CVE-2026-56837
PraisonAI LinearBot processes unsigned webhooks when LINEAR_ -
CVE-2026-93489
ASUS 路由器固件身份验证绕过漏洞 -
CVE-2026-97785
AAD App Proxy Elevation of Privilege Vulnerability
V. Comments for CVE-2026-56836
No comments yet