---
id: GHSA-8ccj-p46r-jwqq
title: >-
  PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally
  disables authentication
summary: >-
  PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally
  disables authentication
severity: high
cvss: 8.2
cwe:
  - CWE-287
vendor: praisonai
product: praisonai
affected:
  - praisonai < 4.6.61
patched:
  - praisonai 4.6.61
published: '2026-06-18'
updated: '2026-06-18'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-8ccj-p46r-jwqq'
references:
  - url: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8ccj-p46r-jwqq
  - url: 'https://github.com/advisories/GHSA-8ccj-p46r-jwqq'
tags:
  - ghsa
  - pip
ingestedAt: '2026-06-19T03:39:00.829Z'
ecosystem: pip
---

## Overview

### Summary
Setting `PRAISONAI_CALL_AUTH=disabled` completely disables all authentication on the `/api/v1/agents/{id}/invoke` endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations.

### Details

```python
# src/praisonai/praisonai/api/agent_invoke.py:32
_CALL_AUTH_DISABLED = os.getenv('PRAISONAI_CALL_AUTH', '').lower() == 'disabled'

async def verify_token(...) -> None:
    if _CALL_AUTH_DISABLED:
        return  # all authentication skipped unconditionally
```

The application's own error message advertises the bypass:
> "Set CALL_SERVER_TOKEN or PRAISONAI_CALL_AUTH=disabled to run without authentication."

This causes the setting to appear in Docker/Compose configurations as a convenience option.

### Proof of Concept

```python
import os
os.environ["PRAISONAI_CALL_AUTH"] = "disabled"
# verify_token() now returns immediately for any request
# POST /api/v1/agents/any-agent/invoke → 200 OK (no token needed)
```

Common vulnerable deployment:

```yaml
# docker-compose.yml
environment:
  - PRAISONAI_CALL_AUTH=disabled  # auth completely disabled
```

### Impact
Full unauthenticated access to the agent invocation API. Any agent registered on the server can be triggered without credentials, potentially executing arbitrary actions depending on the agent's configured tools.

## Affected packages

- `praisonai < 4.6.61`

## Remediation

Upgrade to a patched release:

- `praisonai 4.6.61`