Listen to this Post
PraisonAI implements an agent invocation API through FastAPI, protected by a token verification dependency named verify_token(). When the environment variable `PRAISONAI_CALL_AUTH=disabled` is configured, the application intends to bypass authentication exclusively for requests originating from the local machine. To achieve this, the codebase inspects the incoming request details to determine if the binding host matches loopback addresses such as 127.0.0.1, localhost, or ::1. However, rather than verifying the actual network socket or server-owned startup configuration, the implementation derives the hostname directly from request.url.hostname, which relies entirely on the HTTP `Host` header supplied by the client. An unauthenticated remote attacker can exploit this flaw by sending a crafted HTTP request containing a spoofed `Host: 127.0.0.1` header. Consequently, the application incorrectly assumes the request originates locally, bypassing the security guard and granting full access to list and invoke registered AI agents without providing any valid authentication token.
DailyCVE Form:
Platform: PraisonAI
Version: v4.6.62
Vulnerability : Authentication Bypass
Severity: Critical
date: 2026-10-09
Prediction: 2026-10-20
What Undercode Say
The vulnerability arises from relying on client-supplied request headers rather than server-side state for security decisions. Trusting the HTTP Host header to determine if a connection is local violates core security invariants, allowing trivial spoofing from external networks.
Exploit: (Educational Purposes!)
import httpx
response = httpx.post(
"http://vulnerable-server:8000/api/v1/agents/pov-agent/invoke",
headers={"host": "127.0.0.1"},
json={"message": "host-header-bypass"}
)
print(response.json())
Protection: from this CVE
Avoid deriving security decisions or loopback checks from the HTTP Host header or request URLs. Ensure authentication bypass flags are strictly tied to server-side startup configurations bound exclusively to local sockets, or remove the opt-out mechanism for network-facing routes entirely.
Impact:
Unauthenticated remote attackers can list, inspect, and invoke registered AI agents, potentially leveraging associated tools, private context, file access, and workflow integrations to execute arbitrary actions or exfiltrate sensitive data.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
