PraisonAI ships a legacy Flask API server that, by default, has authentication disabled, exposing the /agents and /chat endpoints. Anyone who can reach the server can trigger the configured agents.yaml workflow without providing a token, enabling arbitrary agent workflow execution. This flaw can allow an attacker to run configured agent workflows, potentially leading to code execution or data access depending on the agent logic, thereby compromising confidentiality, integrity, or availability. The weakness combines missing authentication (CWE‑306), improper authorization (CWE‑668), and configuration exposure (CWE‑1188).

MervinPraison PraisonAI versions from 2.5.6 up to, but not including, 4.6.34 are affected; the flaw was fixed in 4.6.34 and later releases.

The vulnerability has a CVSS score of 7.3, indicating high severity. EPSS score is 27%, indicating a higher likelihood of exploitation, but the lack of authentication makes the attack surface essentially any network user with connectivity to the server. Because the flaw permits execution of configured workflows, an attacker can gain privileged access to internal resources and possibly compromise the system; the vulnerability is not listed in the CISA KEV catalog, yet the open nature of the endpoints means exploitation risks remain significant.