Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| PraisonAI | pip | < 4.6.58 | 4.6.58 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly states that the 'Jobs API create_app function mounts /api/v1/runs without authentication'. The provided commit 2f9677abb2ea68eab864ee8b6a828fd0141612e1 shows a significant change in src/praisonai/praisonai/jobs/server.py within the create_app function. Specifically, a new JobsAPIKeyMiddleware is introduced and added to the application. This middleware enforces authentication by checking for a PRAISONAI_JOBS_API_KEY in the 'Authorization' or 'X-API-Key' headers. The absence of this middleware in the vulnerable version of create_app is the root cause of the authentication bypass. Therefore, praisonai.jobs.server.create_app is identified as the vulnerable function because its execution in the unpatched version directly leads to the insecure configuration where the Jobs API endpoints are publicly accessible without authentication. When exploited, the runtime profile would show calls to the various job handling functions (e.g., for submitting, reading, canceling, or deleting jobs) that are routed by the application configured by create_app.
praisonai.jobs.server.create_appsrc/praisonai/praisonai/jobs/server.py