CVE-2026-56836
PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
Impact
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | praisonai | >= 4.5.112, <= 4.6.58 | 4.6.59 |