GHSA-fq2m-6wqh-x44g: PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: Jobs API exposes agent-execution endpoints with no authentication Researcher: Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI Package: praisonai on PyPI Affected version (empirically tested): 4.6.48 Components: - praisonai.jobs.server.create_app — praisonai/jobs/server.py - praisonai.jobs.router.create_router — praisonai/jobs/router.py - Routes mounted at /api/v1/runs/... Weakness: CWE-306 Missing Authentication for Critical Function · CWE-862 Missing Authorization · CWE-94 Code Injection (via prompt / agent_yaml). TL;DR praisonai ships a standalone async-jobs HTTP server (python -m praisonai.jobs.server --host=0.0.0.0 --port=8005) whose job is to accept job submissions and run agents on the operator's behalf. Every endpoint under /api/v1/runs is unauthenticated. There is no auth_token field, no Depends(verify_*), no middleware that inspects Authorization — the CORS middleware *lists* Authorization in allow_headers (the only signal in the whole module that the developer was aware authentication is a thing), but no route ever reads it. A network-reachable attacker can: 1. Execute arbitrary agent code — POST /api/v1/runs accepts prompt, agent_yaml, agent_file, config, framework. The job is queued and an executor invokes whichever framework (praisonai / crewai / autogen) the attacker picks, with whichever prompt and tool config the attacker supplies. The job runs in the operator's process — same environment variables, same filesystem, same credentials (OpenAI / Anthropic / Azure / Bedrock keys; tool integrations; on-disk YAML recipes). 2. List and read every job system-wide — GET /api/v1/runs lists all jobs; GET /api/v1/runs/{job_id}/result returns the full result of any completed job. Operator's prompts, the agent's chain-of-thought, tool inputs / outputs, retrieved documents — all readable to an anonymous client. 3. Cancel or delete any job — POST /…/cancel and DELET