CVE-2026-55526 is a vulnerability in MervinPraison's PraisonAI multi-agent teams system. Prior to version 1.6.58, the function spider_tools._host_is_blocked() does not properly resolve hostnames before fetching pages, allowing specially crafted hostnames like 127.0.0.1.nip.io to bypass validation and access internal HTTP services. This reliance on reverse DNS resolution for security-critical actions can lead to unauthorized internal network access. The issue is fixed in PraisonAI version 1.6.58 by using socket.getaddrinfo and failing closed on DNS errors.
CVE-2026-55531 is an uncontrolled resource consumption vulnerability in MervinPraison's PraisonAI multi-agent teams system. Prior to version 4.6.58, the MCP HTTP Stream mcp_post handler creates a new session entry for every initialize request without cleaning up old sessions or enforcing a maximum limit. This allows an unauthenticated attacker to exhaust memory resources. The issue is fixed in version 4.6.58 by invoking session cleanup and limiting the number of sessions via PRAISONAI_MCP_MAX_SESSIONS.
PraisonAI versions prior to 1.6.58 have a missing authentication check on AgentServer routes, allowing remote callers to perform actions without valid tokens even when authentication is configured. This vulnerability is fixed in version 1.6.58.
CVE-2026-55529 is a vulnerability in MervinPraison's PraisonAI multi-agent teams system prior to version 4.6.58. The issue arises because the MCP HTTP Stream _validate_origin method incorrectly validates origins by using a startswith check, allowing attacker-controlled origins like localhost.evil.example to bypass the localhost allowlist. This enables a malicious webpage to submit requests to the local MCP server without an API key and execute exposed tools. The vulnerability is fixed in version 4.6.58.
CVE-2026-55525 is a Server-Side Request Forgery (SSRF) vulnerability in MervinPraison PraisonAI, a multi-agent teams system. The vulnerability exists because the web_crawl function only validates the initial URL, but does not revalidate redirect targets when following redirects. This allows an attacker who can influence the crawl target to redirect requests to internal resources such as loopback addresses, private networks, or cloud metadata services, even when ALLOW_LOCAL_CRAWL is disabled. The internal response is then returned to the agent context. This issue is fixed in PraisonAI version 1.6.58.
PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires `min_role="member"`, which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to. Both issues come from the same gap: the route layer pulls `workspace_id` from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The `require_workspace_member()` dependency does its job correctly. The problem is that the service layer doesn't use the information it provides. Version 0.1.4 of the PraisonAI Platform API patch the issue.
PraisonAI versions prior to 1.6.58 contain a time-of-check to time-of-use (TOCTOU) race condition in the web_crawl tool's SSRF protection. The tool validates the initial URL's hostname against private, loopback, and link-local addresses only once, but then follows redirects and re-resolves hostnames without revalidating. This allows attackers to bypass SSRF protections via HTTP redirects or DNS rebinding, potentially causing the host to fetch internal or cloud metadata endpoints and expose sensitive data. The issue is fixed in version 1.6.58.
PraisonAI versions 1.5.128 through 1.6.57 contain a server-side request forgery (SSRF) vulnerability in the web_crawl() function. The vulnerability arises because the function validates only the initially supplied URL but does not revalidate intermediate or final redirect targets when following redirects. This allows an attacker to supply a URL that passes initial checks but redirects to internal or sensitive endpoints, potentially exposing internal network resources. The issue has been fixed in version 1.6.58.
PraisonAI versions 3.9.26 through 4.6.57 and praisonaiagents versions 0.12.12 through 1.6.57 contain a code injection vulnerability in the workflow "include" feature. The vulnerability arises because the _execute_include() function imports and executes an included recipe's tools.py file without enforcing security gates or using a safe loader. This allows arbitrary Python code execution if an attacker can cause a workflow to include an untrusted local recipe. The issue is fixed in versions 4.6.58 and 1.6.58 respectively.
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.
PraisonAI Platform versions prior to 0.1.4 contain an authorization bypass vulnerability due to insecure direct object references in agent CRUD endpoints. Users who are members of any workspace can access agents belonging to other workspaces by manipulating agent IDs without proper workspace validation. This allows unauthorized reading, modification, or deletion of agents across workspaces. Version 0.1.4 addresses this issue.
CVE-2026-47418 is an authorization bypass vulnerability in the PraisonAI Platform prior to version 0.1.4. The platform's project-related endpoints check only workspace membership but do not properly constrain project access by workspace, allowing users to access projects in other workspaces. This insecure direct object reference (IDOR) flaw permits unauthorized reading, modification, deletion, or statistics viewing of projects outside a user's workspace.
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comment endpoints (`POST /workspaces/{workspace_id}/issues/{issue_id}/comments` and `GET .../comments`) gate access on `require_workspace_member(workspace_id)` only, then call `CommentService.create(issue_id=issue_id, ...)` and `CommentService.list_for_issue(issue_id)` without verifying that `issue_id` belongs to `workspace_id`. A user who is a member of any workspace `W1` can read every comment on, and post new comments to, any issue in any other workspace `W2`. PraisonAI Platform version 0.1.4 patches the issue.
PraisonAI Platform versions prior to 0.1.4 contain a vulnerability allowing vertical privilege escalation via the workspace member role update endpoint. The API endpoint for updating member roles does not properly verify that the caller has sufficient privileges or restricts role elevation, enabling unauthorized users to promote themselves or others to higher roles. Version 0.1.4 addresses this issue.
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issue CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/issues/{issue_id}`) gate access on `require_workspace_member(workspace_id)` only, then resolve `issue_id` through `IssueService.get(issue_id)` which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace `W1` can read, modify, or delete issues that belong to a different workspace `W2`. PraisonAI Platform version 0.1.4 patches the issue.
CVE-2026-47414 is an authorization bypass vulnerability in the PraisonAI Platform prior to version 0.1.4. The issue arises because five label-related API endpoints only verify workspace membership but do not confirm that the label_id or issue_id parameters belong to the specified workspace. This allows unauthorized access to labels and issues across workspaces. The vulnerability is fixed in version 0.1.4.
CVE-2026-47413 is a critical privilege escalation vulnerability in the PraisonAI Platform prior to version 0.1.4. The vulnerability allows a user with minimal workspace privileges to escalate their role to owner by exploiting insufficient permission checks in the member addition API endpoint. This enables unauthorized privilege escalation and potential cross-tenant member injection. The issue is patched in version 0.1.4.
PraisonAI Platform versions prior to 0.1.4 contain an authorization bypass vulnerability in the DELETE /workspaces/{workspace_id} endpoint. Any workspace member, regardless of role, can delete the entire workspace and all associated data without additional authorization checks or recovery options. This issue is fixed in version 0.1.4.
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member can rewrite the workspace's `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object — depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there. PraisonAI Platform version 0.1.4 patches the issue.
PraisonAI Platform versions prior to 0.1.4 use a hard-coded default cryptographic key for JWT signing when the environment variable PLATFORM_JWT_SECRET is unset. The default key is the literal "dev-secret-change-me", which is publicly accessible in the source code. Because the safety check to prevent this default key usage only triggers when PLATFORM_ENV is not "dev" (and the default is "dev"), many deployments silently use this insecure key. An attacker can exploit this by crafting JWT tokens with arbitrary claims to impersonate any user, including admins. Version 0.1.4 of PraisonAI Platform addresses this vulnerability by removing the insecure default key.