CVE-2026-61435 MervinPraison CVE debrief

Who should care

Defenders responsible for PraisonAI deployments should assess exposure and prioritize patching to prevent potential authentication bypass. This includes reviewing the affected versions of PraisonAI, applying the patch, and verifying that the API is not exposed to untrusted networks. Additionally, defenders should monitor the API for suspicious activity and review compensating controls for exposed systems.

Why it matters

CVE-2026-61435 is a vulnerability in PraisonAI's n8n/call agent invocation API that allows an unauthenticated network caller to list and invoke registered agents when the service is reachable and the opt-out is enabled.

• An unauthenticated network caller can list registered agents.
• An unauthenticated network caller can invoke registered agents.
• Defenders should verify the affected versions of PraisonAI and apply the patch.

Technical summary

The vulnerability is caused by a flawed implementation of the `verify_token()` function in `src/praisonai/praisonai/api/agent_invoke.py`. The function does not properly validate the `Host` header, allowing an attacker to bypass authentication. This issue arises when the `PRAISONAI_CALL_AUTH=disabled` safeguard is enabled, which is intended to disable authentication for localhost bindings. However, due to the spoofable nature of the `Host` header, an unauthenticated network caller can exploit this vulnerability to list and invoke registered agents.

Defensive priority

Defenders should prioritize verifying the affected versions of PraisonAI and applying the patch to prevent potential authentication bypass.

Recommended defensive actions

• Verify the version of PraisonAI and apply the patch to prevent potential authentication bypass.
• Restrict access to the n8n/call agent invocation API to only trusted hosts.
• Monitor the API for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by a flawed implementation of the `verify_token()` function in `src/praisonai/praisonai/api/agent_invoke.py`. The function does not properly validate the `Host` header, allowing an attacker to bypass authentication.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.