taxonomy / tag

#agent-framework

29.08.2026

CVE-2026-55533: PraisonAI Recipe Server Authentication Fail-Open

CVE-2026-55533 is a fail-open authentication bug in the PraisonAI Recipe server: selecting api-key or jwt without supplying the matching secret leaves every recipe endpoint open, and the CLI safety check for non-localhost binding never notices.

29.08.2026

CVE-2026-55529: PraisonAI MCP Origin Validation Bypass

CVE-2026-55529 turns one call to startswith() into a browser-mediated attack on a local MCP server: because http://localhost.evil.example begins with http://localhost, a malicious webpage can drive tools/call against an unauthenticated agent running on the victim's own machine.