PraisonAI Recipe Server Unauthenticated Network Exposure

PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in src/praisonai/praisonai/cli/commands/recipe.py. That Typer command can start the Recipe HTTP server on a non-localhost interface with no authentication. It prints a deprecation warning, and then launches the server. Because config.auth is absent, create_app() does not attach the API-key or JWT middleware. Unauthenticated requests can then reach the recipe API and, when enabled, /admin/reload. This issue has been patched in version 4.6.59.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

PraisonAI versions 4.5.112 through 4.6.58 contain a critical authentication bypass vulnerability in the deprecated Recipe HTTP server functionality. The vulnerability allows an attacker to start the Recipe server on non-localhost network interfaces without any authentication requirements, potentially exposing the multi-agent system to unauthorized remote access. This affects organizations using PraisonAI for agent orchestration and automation workflows, particularly those deploying the platform in containerized or cloud environments where network boundaries may be less restrictive than traditional on-premises setups.

Casky's 283 mapped security skills detect the attack patterns underlying this CVE by analyzing MITRE ATT&CK tactics TA0004 (Privilege Escalation) and TA0006 (Credential Access) through Claude's extended reasoning capabilities. Practitioners would observe Casky flagging CWE-287 (Improper Authentication) patterns where network services lack credential validation, CWE-306 (Missing Authentication for Critical Function) indicating the Recipe server dispatch bypasses security checks, and CWE-862 (Missing Authorization) showing unauthenticated command execution. Detection would surface suspicious Typer CLI command registration patterns, unprotected HTTP server initialization on non-localhost bindings, and deprecated code paths that circumvent authentication mechanisms—enabling security teams to identify vulnerable PraisonAI deployments before exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-56836.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-56836

Casky has 283 skills that investigate the attack patterns behind CVE-2026-56836. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn