The vulnerability resides in the Jobs API endpoint /api/v1/runs, which prior to version 4.6.51 was mounted without authentication. An unauthenticated caller can submit jobs, read job results, cancel runs, or delete jobs using operator credentials. Because the endpoint accepts operator level actions without verifying identity, attackers can submit arbitrary jobs, harvest sensitive results, or terminate legitimate work. This constitutes an authentication bypass that allows complete compromise of job control.

The affected product is PraisonAI, developed by MervinPraison. Versions of PraisonAI released before 4.6.58, especially the range 4.6.51 to 4.6.57, are vulnerable. All other versions, including 4.6.58 and later, have the PRAISONAI_JOBS_API_KEY middleware that enforces authentication via an Authorization header or X-API-Key.

The CVSS score of 8.6 classifies this as High severity. No EPSS score is published, so the current probability of exploitation is unknown, but the lack of authentication means the attack can be performed remotely from any reachable host. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Nonetheless, administrators should treat it as a critical remediation priority due to the full unauthorized control that could be gained.