GHSA-8ccj-p46r-jwqq: PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

June 18, 2026 (updated July 20, 2026)

Setting PRAISONAI_CALL_AUTH=disabled completely disables all authentication on the /api/v1/agents/{id}/invoke endpoint. This bypass is advertised in the application’s own error messages, making it likely to appear in production Docker and Compose configurations.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8ccj-p46r-jwqq
github.com/advisories/GHSA-8ccj-p46r-jwqq
nvd.nist.gov/vuln/detail/CVE-2026-57132

Code Behaviors & Features

Detect and mitigate GHSA-8ccj-p46r-jwqq with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →