CVE-2026-57134

8.2 Élevée

Publiée le 15/09/2026 à 13:17 · Modifiée le 15/09/2026 à 16:45 · Analyse NVD reportée · Source : security-advisories@github.com

Description

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2.

Traduire en français

Produits concernés

MervinPraison PraisonAI

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.2 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N`

Faiblesses (CWE)

CWE-287
CWE-288
CWE-863

Références

https://github.com/MervinPraison/PraisonAI/commit/709a0387853709a5e2f2c34680fa64cada252c27
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.60
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4qq2-2j2x-x62c
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4qq2-2j2x-x62c

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories