Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| PraisonAI | pip | < 4.6.58 | 4.6.58 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-55533, lies in the authentication middleware creation logic of PraisonAI. The function praisonai.recipe.serve.create_auth_middleware is responsible for generating the authentication middleware for the recipe server. The vulnerability arises because this function creates a middleware that 'fails open'. Specifically, if the authentication type is set to 'api-key' or 'jwt', but the corresponding secret (API key or JWT secret) is not configured in the environment, the middleware incorrectly permits the request to proceed as if it were authenticated. The patch rectifies this by changing the behavior to 'fail closed'. Instead of allowing the request, the patched code returns a 503 'misconfigured' error, correctly blocking unauthenticated access when the authentication secret is missing. The vulnerable function is create_auth_middleware as it contains the flawed logic for generating the insecure middleware. The runtime effect is that the dispatch method of the generated middleware allows unauthenticated requests to pass through.
praisonai.recipe.serve.create_auth_middlewaresrc/praisonai/praisonai/recipe/serve.py