GHSA-2jgc-f764-c5r2: PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete
Summary
PraisonAI's Jobs API (a FastAPI service that runs AI agent jobs) has no authentication checks on any of its endpoints. This means anyone who can reach the server can submit jobs to run against the system's AI credentials, view all jobs and their results, cancel running jobs, and delete completed jobs without providing any token, password, or proof of identity. The vulnerability is separate from a similar bug that was already fixed in an older Flask-based API component, but this FastAPI jobs module was left unpatched.
Vulnerability Details
EPSS: 0.0%
Yes
August 25, 2026
Classification
Affected Vendors
Affected Packages
Related Issues
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
CVE-2024-27444: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-
Original source: https://github.com/advisories/GHSA-2jgc-f764-c5r2
First tracked: August 25, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 95%