Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description clearly states that 'recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET and the corresponding recipe value are absent.'
Upon analyzing the provided commit 2f9677abb2ea68eab864ee8b6a828fd0141612e1, the file src/praisonai/praisonai/recipe/serve.py shows direct modifications to the dispatch methods within both APIKeyAuthMiddleware and JWTAuthMiddleware classes.
Specifically, the removed lines of code in both dispatch methods (if not expected_key: return await call_next(request) and if not secret: return await call_next(request)) demonstrate that previously, if the respective authentication credentials (API key or JWT secret) were not set, the middleware would bypass authentication and allow the request to proceed. The added code replaces this bypass with a JSONResponse indicating a misconfiguration and returning a 503 status code, effectively 'failing closed' rather than 'failing open'.
These changes directly address the described vulnerability, confirming that the dispatch methods of these two middleware classes were the points of failure where unauthenticated requests were inadvertently permitted.
APIKeyAuthMiddleware.dispatchsrc/praisonai/praisonai/recipe/serve.py
JWTAuthMiddleware.dispatchsrc/praisonai/praisonai/recipe/serve.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| praisonai | pip | <= 4.6.48 | 4.6.59 |