{"id":"GHSA-8ccj-p46r-jwqq","title":"PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication","summary":"PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication","severity":"high","cvss":8.2,"cwe":["CWE-287"],"vendor":"praisonai","product":"praisonai","affected":["praisonai < 4.6.61"],"patched":["praisonai 4.6.61"],"published":"2026-06-18","updated":"2026-06-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-8ccj-p46r-jwqq","references":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8ccj-p46r-jwqq"},{"url":"https://github.com/advisories/GHSA-8ccj-p46r-jwqq"}],"tags":["ghsa","pip"],"ingestedAt":"2026-06-19T03:39:00.829Z","ecosystem":"pip","slug":"GHSA-8ccj-p46r-jwqq","body":"## Overview\n\n### Summary\nSetting `PRAISONAI_CALL_AUTH=disabled` completely disables all authentication on the `/api/v1/agents/{id}/invoke` endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations.\n\n### Details\n\n```python\n# src/praisonai/praisonai/api/agent_invoke.py:32\n_CALL_AUTH_DISABLED = os.getenv('PRAISONAI_CALL_AUTH', '').lower() == 'disabled'\n\nasync def verify_token(...) -> None:\n    if _CALL_AUTH_DISABLED:\n        return  # all authentication skipped unconditionally\n```\n\nThe application's own error message advertises the bypass:\n> \"Set CALL_SERVER_TOKEN or PRAISONAI_CALL_AUTH=disabled to run without authentication.\"\n\nThis causes the setting to appear in Docker/Compose configurations as a convenience option.\n\n### Proof of Concept\n\n```python\nimport os\nos.environ[\"PRAISONAI_CALL_AUTH\"] = \"disabled\"\n# verify_token() now returns immediately for any request\n# POST /api/v1/agents/any-agent/invoke → 200 OK (no token needed)\n```\n\nCommon vulnerable deployment:\n\n```yaml\n# docker-compose.yml\nenvironment:\n  - PRAISONAI_CALL_AUTH=disabled  # auth completely disabled\n```\n\n### Impact\nFull unauthenticated access to the agent invocation API. Any agent registered on the server can be triggered without credentials, potentially executing arbitrary actions depending on the agent's configured tools.\n\n## Affected packages\n\n- `praisonai < 4.6.61`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `praisonai 4.6.61`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}