Loading vulnerability…
PraisonAI Call API Authentication Bypass via Host Header Spoofing
CVE-2026-61435 is an authentication bypass in the Call API agent invocation endpoints of PraisonAI before version 4.6.78. When PRAISONAI_CALL_AUTH=disabled is configured, a safeguard intended to restrict unauthenticated operation to localhost derives the bind host from request.url.hostname, which reflects the client-controlled HTTP Host header rather than the server's actual listening configuration. A remote, unauthenticated attacker with network access can supply a localhost-valued Host header to bypass the safeguard and enumerate or invoke registered agents. The vulnerability requires a nondefault disabled-authentication configuration.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthenticated network callers can enumerate registered agents and invoke them with their existing capabilities and permissions. Depending on agent configuration, unauthorized invocation could expose private context, modify data, trigger workflows, access files or external APIs, or consume paid model resources. Agent listing and invocation were demonstrated; the additional capability-dependent consequences were not all demonstrated.
If you can’t patch tonight, do this now.
Do not configure PRAISONAI_CALL_AUTH=disabled on network-reachable deployments. Restore authentication and configure CALL_SERVER_TOKEN; the demonstrated default-authentication behavior fails closed when no token is configured. If unauthenticated local development is necessary, bind the actual listening socket exclusively to loopback, enforce network access restrictions, and prevent exposure through proxies or port forwarding. Do not rely on the HTTP Host header to establish local-only access.
Patch, then assume compromise.
Upgrade PraisonAI and applicable related packages to version 4.6.78 or later. The structured affected-package metadata identifies 4.6.78 as fixed, although one advisory narrative states that the fixed version is unknown. The suggested code-level correction is to validate disabled-authentication mode at startup using server-owned bind configuration, reject non-loopback bindings, and never make that decision from request URLs or headers. Add regression tests ensuring that spoofed localhost Host headers cannot reach agent handlers when the server is configured for non-loopback listening.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.