Description
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
Published: 2026-05-08
Score: 7.3 High
EPSS: 28.6% Moderate
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

PraisonAI bundles a legacy Flask API server with authentication disabled by default for versions 2.5.6 up to before 4.6.34. The /agents and /chat endpoints expose a configured agents.yaml workflow that can be triggered without a token. This allows an attacker to run any workflow defined in the configuration, potentially enabling unauthorized data access or code execution depending on the agent logic. The weakness stems from missing authentication (CWE‑306), improper authorization (CWE‑668), and exposed configuration (CWE‑1188).

Affected Systems

MervinPraison PraisonAI versions 2.5.6 through 4.6.33 are vulnerable; the issue is resolved in version 4.6.34, which requires authentication by default.

Risk and Exploitability

The CVSS score of 7.3 denotes high severity, and the EPSS score of 29% indicates a significant likelihood of exploitation. Because no authentication is required, any network user who can reach the legacy API server can invoke the /chat or /agents endpoints, effectively gaining privileged workflow execution. The vulnerability is not listed in the CISA KEV catalog, but the open endpoints keep exploitation risk high.

Generated by OpenCVE AI on August 3, 2026 at 07:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to PraisonAI 4.6.34 or later, where the legacy API server enforces authentication by default.
  • If upgrading cannot be performed immediately, restrict network reach to the legacy Flask server to trusted subnets or block all external traffic with firewall rules.
  • As a temporary workaround, block the /agents and /chat endpoints or force token authentication through a reverse proxy or application configuration.

Generated by OpenCVE AI on August 3, 2026 at 07:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-6rmh-7xcm-cpxj PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
History

Fri, 08 May 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Mervinpraison
Mervinpraison praisonai
Vendors & Products Mervinpraison
Mervinpraison praisonai

Fri, 08 May 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Praison
Praison praisonai
CPEs cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*
Vendors & Products Praison
Praison praisonai

Fri, 08 May 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 08 May 2026 14:00:00 +0000

Type Values Removed Values Added
Description PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
Title PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Weaknesses CWE-1188
CWE-306
CWE-668
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Mervinpraison Praisonai
Praison Praisonai
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-05-08T14:14:43.177Z

Reserved: 2026-05-05T19:52:59.147Z

Link: CVE-2026-44338

cve-icon Vulnrichment

Updated: 2026-05-08T14:14:39.092Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-08T14:16:46.733

Modified: 2026-06-17T10:50:31.593

Link: CVE-2026-44338

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T08:00:04Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-668

    Exposure of Resource to Wrong Sphere