Logo
Retour à la veille

CVE-2026-57134

Publié : 15 septembre 2026
Modifié : 15 septembre 2026
Lien officiel NVD
Score CVSS
8.2
HIGH

Description détaillée

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Références et Patchs

https://github.com/MervinPraison/PraisonAI/commit/709a0387853709a5e2f2c34680fa64cada252c27https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.60https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4qq2-2j2x-x62chttps://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4qq2-2j2x-x62c

Dernières Vulnérabilités

CVE-2026-92079

Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

VOIR DÉTAILS

CVE-2026-92078

Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

VOIR DÉTAILS

CVE-2026-92077

Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

VOIR DÉTAILS