Description
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
Published: 2026-05-08
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Workflow Execution
Action: Immediate Patch
AI Analysis

Impact

PraisonAI ships a legacy Flask API server with authentication disabled by default. Any caller that can reach the server can access /agents and trigger the agents.yaml workflow through /chat without a token. This allows an attacker to execute any workflow defined in the configuration. Based on the description, it is inferred that the attacker could cause unintended system actions or data handling as dictated by the pre‑configured workflow logic.

Affected Systems

Vulnerable versions of MervinPraison PraisonAI are 2.5.6 through 4.6.33. The issue is resolved in version 4.6.34, which requires authentication for the legacy API server.

Risk and Exploitability

The CVSS score of 7.3 signifies high severity, while the EPSS score of <1% indicates a very low but nonzero chance of exploitation. Because no authentication is required, any network user who can reach the legacy API endpoints can invoke /agents or /chat, effectively gaining privileged workflow execution. The vulnerability is not listed in the CISA KEV catalog, but the open endpoints keep exploitation risk high. Based on the description, the likely attack vector is an unauthenticated network connection to the exposed Flask API.

Generated by OpenCVE AI on September 24, 2026 at 23:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to PraisonAI 4.6.34 or later, where the legacy API server enforces authentication by default.
  • If upgrading cannot be performed immediately, restrict network access to the legacy Flask server to trusted subnets or block all external traffic with firewall rules.
  • As a temporary workaround, block the /agents and /chat endpoints or force token authentication through a reverse proxy or application configuration.

Generated by OpenCVE AI on September 24, 2026 at 23:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-6rmh-7xcm-cpxj PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
History

Fri, 08 May 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Mervinpraison
Mervinpraison praisonai
Vendors & Products Mervinpraison
Mervinpraison praisonai

Fri, 08 May 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Praison
Praison praisonai
CPEs cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*
Vendors & Products Praison
Praison praisonai

Fri, 08 May 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 08 May 2026 14:00:00 +0000

Type Values Removed Values Added
Description PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
Title PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Weaknesses CWE-1188
CWE-306
CWE-668
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Mervinpraison Praisonai
Praison Praisonai
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-05-08T14:14:43.177Z

Reserved: 2026-05-05T19:52:59.147Z

Link: CVE-2026-44338

cve-icon Vulnrichment

Updated: 2026-05-08T14:14:39.092Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-08T14:16:46.733

Modified: 2026-06-17T10:50:31.593

Link: CVE-2026-44338

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T00:00:11Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-668

    Exposure of Resource to Wrong Sphere