PraisonAI’s AgentTeam.launch and the associated Agents alias expose several HTTP endpoints without any access‑control checks. The GET /{path}/list endpoint permits enumeration of all configured agents, while POST /{path} and POST /{path}/{agent_id} allow callers to invoke agent.chat and trigger internal tool usage or workflow side effects. Because the requests are unauthenticated, an attacker can consume model resources, access private agent context, and potentially execute arbitrary agent‑level work‑flows, effectively exposing sensitive data and system functionality.

The flaw impacts the MervinPraison PraisonAI platform and its praisonaiagents component. All releases of praisonaiagents before version 1.6.59 are affected; later releases contain the fix and are not impacted. No other products or vendors are listed as vulnerable.

The CVSS score of 9.8 denotes extremely high severity. The absence of authentication requirements means an attacker only needs to send HTTP requests to an exposed server to enumerate or invoke agents. The EPSS score is not available, but the nature of the flaw strongly suggests a high likelihood of exploitation. The issue is not listed in CISA’s KEV catalog, although a vendor patch has been released for praisonaiagents v1.6.59.