PraisonAI: Missing authentication in recipe serve Typer command
Summary
The deprecated Typer command 'praisonai recipe serve' can start the Recipe HTTP server on a non-localhost interface without authentication. Because no auth middleware is attached in this path, unauthenticated remote users can reach the recipe API and, if admin mode is enabled, the /admin/reload endpoint. The issue requires only network access to the bound interface and no credentials.
Affected
- PraisonAI from 4.5.112 up to but not including 4.6.59 (GHSA lists <= 4.6.58)
- Installations that run 'praisonai recipe serve' with a non-localhost host such as 0.0.0.0
Fixed in
- Fixed in PraisonAI 4.6.59
Workaround
- Do not use 'praisonai recipe serve' on public interfaces
- Bind the server to 127.0.0.1 only
- Block the recipe server port with a host or network firewall
- Disable admin endpoints until patched
- Note: these measures are recommendations, not vendor-documented mitigations
Exploitation
- No evidence of exploitation in the wild known at time of research
- No public proof-of-concept known; CISA SSVC lists exploitation as 'poc' and automatable as yes
- Not listed in CISA KEV
Our recommendation
- Inventory all praisonai installations and versions; flag anything below 4.6.59
- Search scripts, Dockerfiles and systemd units for 'recipe serve' and remove non-localhost binds without authentication
- Upgrade to PraisonAI 4.6.59 or later
- Where a non-localhost bind is needed, use the auth-enabled command with api-key authentication
- Check firewall rules and logs for unexpected access to the recipe server port
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5qw8-f2g9-ff29 github.com
- OSV GHSA-5qw8-f2g9-ff29 osv.dev
- Vulners NVD CVE-2026-56836 vulners.com
- VulDB 425684 vuldb.com
- PraisonAI recipe serve documentation docs.praison.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:07.
Original description (NVD)
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.