PraisonAI ships a legacy Flask API server that, by default, has authentication disabled, exposing the /agents and /chat endpoints. Anyone who can reach the server can trigger the configured agents.yaml workflow without providing a token, enabling arbitrary agent execution. This flaw can allow an attacker to run code or access sensitive data depending on the agent logic, thereby compromising confidentiality, integrity, or availability. The weakness combines missing authentication, improper authorization, and configuration exposure, reflected in CWE‑1188, CWE‑306, and CWE‑668.

MervinPraison PraisonAI versions from 2.5.6 up to, but not including, 4.6.34 are affected; the flaw was fixed in 4.6.34 and later releases.

The vulnerability has a CVSS score of 7.3, indicating high severity. EPSS data is not available, but the lack of authentication makes the attack surface essentially any network user with connectivity to the server. Because the flaw permits execution of configured workflows, an attacker could potentially elevate privileges or bypass isolation boundaries. The vulnerability is not listed in the CISA KEV catalog, yet the possibility of exploitation remains significant due to the open nature of the endpoints.