PraisonAI authentication bypass — CVE-2026-44338 + platform CVEs (May 2026)

TL;DR

CVE-2026-44338 (CVSS 7.3) — PraisonAI's legacy Flask API server (api_server.py, versions 2.5.6 → 4.6.33) shipped with AUTH_ENABLED = False hard-coded, exposing GET /agents and POST /chat to anyone on the network. Sysdig honeypots saw the first targeted exploit attempt 3 hours, 44 minutes after the advisory was published — among the fastest public-disclosure-to-scan times yet observed for an AI-agent framework CVE. Fixed in PraisonAI 4.6.34; upgrade or switch to the new serve agents command (binds 127.0.0.1, requires --api-key).

What happened

On 2026-05-11 at 13:56 UTC, GitHub published advisory GHSA-6rmh-7xcm-cpxj for PraisonAI, an open-source multi-agent orchestration framework. The legacy Flask entrypoint shipped with two "protected" routes:

• GET /agents — returns the configured agent metadata, including the agent definition filename and the list of agents.
• POST /chat — accepts any JSON body containing a message key and dispatches it to the configured agent.

The check_auth() helper returned True whenever AUTH_ENABLED was False, which it always was by default. Both routes failed open.

At 17:40 UTC the same day — 3h44m39s after publication — a Sysdig-monitored honeypot saw the first targeted probe from a scanner identifying itself as CVE-Detector/1.0. The traffic only enumerated agent metadata (no exploit POSTs observed), consistent with a validation/reconnaissance run before later weaponization.

This compresses the same "disclosure-to-exploit" gap that hit Langflow in 2025 (also a Python AI-agent framework) but is even tighter. The pattern is now well-established: any AI-agent framework that gets a CVE will be scanned for it inside one workday.

Am I affected?

# Check version
pip show praisonai 2>/dev/null | grep -E '^(Name|Version):'

# Did you expose the legacy api_server?
ps eww | grep -E 'praisonai.*api_server|python.*api_server\.py'
ss -tlnp 2>/dev/null | grep -E ':5000|:8000' # default Flask ports

If you ran python api_server.py (or the praisonai api subcommand on a vulnerable version) on a publicly reachable interface, treat the host as compromised: attackers could enumerate agents, send arbitrary chat messages, and depending on agent tool wiring, get RCE or LLM-cost drain.

IOCs

If you are affected

1. Upgrade immediately: pip install --upgrade 'praisonai>=4.6.34'.
2. Stop running api_server.py directly. Use praisonai serve agents (the new entrypoint) which binds to 127.0.0.1 and requires --api-key.
3. If the legacy server was exposed: rotate any LLM API keys the agent had access to (token theft via cost abuse is the obvious post-exploit move), rotate any tool-use credentials (DB, GitHub, cloud) the agent's tools could call, and review LLM provider logs for unexpected request volume between 2026-05-11 and your patch date.
4. Audit any agent definition files exposed via /agents — they may have leaked tool descriptions an attacker can now target.

Prevention

→ prevention/agent-sandboxing.md → prevention/credential-hygiene.md → Never expose agent-framework dev servers to the public internet. Default-bind to 127.0.0.1, put a real reverse proxy with auth in front, or route through a tunnel (Tailscale, Cloudflare Tunnel, Ngrok with basic auth). → Treat disclosure-to-exploit as <4 hours for any AI-agent framework. Subscribe to vendor security advisories; consider Dependabot security updates with auto-merge for these packages.

June 2026 update — praisonai-platform package: four additional CVEs

A second cluster of vulnerabilities affecting the praisonai-platform PyPI package (the newer multi-tenant deployment surface, distinct from the legacy api_server.py covered by CVE-2026-44338) was disclosed in mid-2026:

Fix: Upgrade praisonai-platform to the patched version per the GitHub advisory. If you run a multi-tenant PraisonAI Platform deployment, treat any workspace with untrusted members as potentially compromised for the IDOR and privilege-escalation bugs; treat any internet-exposed A2A endpoint as having been reachable without credentials.

June 2026 update — MCP path-traversal RCE (CVE-2026-44336) and CWD tools.py injection (CVE-2026-40156)

Two additional high/critical vulnerabilities in PraisonAI's MCP surface and tool-loading logic were disclosed in June 2026:

CVE-2026-44336 (CVSS 9.4, GHSA-9mqq-jqxf-grvw) — MCP tools/call path-traversal → .pth injection → RCE

PraisonAI's default MCP tool set includes file-manipulation tools (praisonai.rules.create, praisonai.rules.update, praisonai.rules.read, and related methods). These tools accept a filename parameter and write to the path without adequate traversal validation. A local attacker (or a prompt-injected agent) can supply a path like ../../../../site-packages/evil.pth to write a Python .pth file into the active Python environment's site-packages/ directory. A .pth file added to site-packages/ is executed automatically at every subsequent Python interpreter startup — achieving persistent, arbitrary code execution on the PraisonAI host. No authentication is required on the MCP tools/call endpoint in default configurations. Fixed in PraisonAI ≥ 4.6.34 (same release that patched CVE-2026-44338).

CVE-2026-40156 — Arbitrary code injection via tools.py auto-loading from CWD

PraisonAI uses importlib.util.spec_from_file_location to auto-load a file named tools.py from the current working directory at startup. If an attacker can place a malicious tools.py in a directory where praisonai is run (e.g., via a supply-chain-poisoned project, a compromised MCP server, or a shared development directory), the file is executed with the full privileges of the Python process on every PraisonAI startup — no additional user action needed.

Remediation for CVE-2026-44336 and CVE-2026-40156: 1. Upgrade to praisonai >= 4.6.34 (already required for CVE-2026-44338). 2. Audit site-packages/ directories in your Python environment for unexpected .pth files: python -c "import site; print(site.getsitepackages())" then ls -la <site-packages>/ looking for recently modified .pth files. 3. Avoid running praisonai in directories that accept untrusted files (shared project roots, downloaded repos). 4. If you use PraisonAI in an MCP multi-agent context, audit the MCP tools/call history for path-traversal attempts.

June 2026 update — CVE-2026-39891: template injection via unescaped agent.start() input (CVSS 8.8)

CVE-2026-39891 (CVSS 8.8) — A template injection vulnerability in PraisonAI's create_agent_centric_tools() function allows an attacker with the ability to influence the input passed to agent.start() to inject malicious template syntax that the framework evaluates in the server context. The agent.start() call passes the user's task string directly into the tool-construction pipeline without escaping it, enabling injection of template directives that access the server's environment variables, file system, or execution context — depending on the template engine in use.

Scope: Any deployment where end-users or untrusted callers can influence the task string passed to agent.start() — including multi-tenant PraisonAI Platform deployments, API endpoints that expose agent execution, or any LLM-driven orchestration where the LLM's output is passed to agent.start() (a prompt-injection-to-template-injection chain).

Remediation: Upgrade to praisonai >= 4.6.34 (the same release that addressed CVE-2026-44338 and CVE-2026-44336, with additional input sanitization).

September 2026 update — a ~30-CVE mass audit lands across the Python, TypeScript and platform packages, with five+ unauthenticated CVSS 9.8 RCEs

On 2026-09-14 and 2026-09-15 GitHub (as CNA) published roughly thirty CVEs against PraisonAI at once (CVE-2026-56839, CVE-2026-57112, CVE-2026-57119 through CVE-2026-57148), spanning the praisonaiagents (Python), praisonai-ts (TypeScript) and praisonai_platform packages. This is a systematic sweep of the same failure modes the original advisory named — network services binding 0.0.0.0 with authentication that fails open, and allowlists that check only the first token — now enumerated across every server surface. Confirmed against the NVD API; fixed across praisonai 4.6.59 / 4.6.60 / 4.6.62 (with praisonaiagents 1.6.59 / 1.7.2 and platform 0.1.6). The unauthenticated-RCE headliners:

Two of these encode lessons this repo has logged before: CVE-2026-57133 / -57136 (allowlist checks only the first whitespace token, then passes the whole string to child_process.exec/sh -c) is the exact GraphQL-comma / find--exec bypass shape, and CVE-2026-57138 recovers the real Function constructor via ({}).constructor.constructor out of a with(sandbox) blocklist — the same JS-sandbox-escape primitive as jsonata and vm2/isolated-vm. EPSS for the RCEs is low and no in-the-wild exploitation is reported yet — but the original CVE-2026-44338 was probed 3h44m after disclosure, so the same-workday rule applies. Upgrade to praisonai ≥ 4.6.62 (praisonaiagents ≥ 1.7.2, platform ≥ 0.1.6); never expose any PraisonAI server surface, MCP endpoint, Jobs API or recipe server on 0.0.0.0; and set PLATFORM_JWT_SECRET / PRAISONAI_API_KEY explicitly rather than trusting an opt-in that fails open.

Update 2026-10-07 — the AgentMail webhook CVEs reach the database (vendor 06-25, VulnCheck CVEs 07-11/07-15, database 10-07), a platform IDOR gets CVE-2026-62179, and the vendor's own tab is now eighteen pages of advisories

Three PraisonAI rows appeared on the advisory database's agent/llm recency listings on 2026-10-07; all three are old by the vendor's clock, and the dates matter:

• CVE-2026-61436 — AgentMail webhook mode accepts forged, unsigned message.received events and invokes agents (GHSA-7c92-x8vg-4258). The webhook handler "accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures" — the svix-id / svix-timestamp / svix-signature headers are never checked and the webhook secret from client.webhooks.create() is never stored — so anyone who can reach the endpoint invokes the configured agents with an arbitrary sender, subject and body, and the agent replies under the inbox identity. Vendor advisory 2026-06-25; VulnCheck CNA record 2026-07-15, CVSS 4.0 8.8 / 3.1 8.6; affected < 4.6.78, fixed 4.6.78; two fix commits referenced. Reporter rexpository.
• CVE-2026-61428 — AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing (GHSA-qj9c-59p6-8cgx) — the same hole described from the allow/block-list side: spoofed senders bypass the lists, replies go to attacker-chosen addresses, cost abuse through unauthorised invocation. Vendor 2026-06-25; VulnCheck CNA 2026-07-11, CVSS 4.0 6.9 / 3.1 7.3; fixed 4.6.78. Reporter dinhvaren. The two ids describe one bug reported twice; this file counts them as one finding.
• CVE-2026-62179 — platform members can delete owner issue dependencies through member-owned related issues (praisonai-platform < 0.1.9, GitHub-as-CNA 2026-10-07, CVSS 3.1 6.5): the dependency-deletion route accepted either end of the edge and checked ownership on the wrong one.

The tab. MervinPraison/PraisonAI/security/advisories now paginates to 18 pages; pages 1–2 alone hold twenty advisories dated 2026-06-25 — the SubprocessSandbox SecurityPolicy that is "completely unenforced" (Critical), a prompt-injection defence that "blocks only when 3+ detector families fire simultaneously," tool approvals cached by tool name and reused for any arguments, web_crawl SSRF via DNS rebinding and the Crawl4AI backend, the find -exec allowlist bypass, a Host-header localhost auth bypass, and a "Remote Code Execution via Broken AST Sandbox." None of those has a CVE on the vendor page; the ~30-CVE September wave above is the CNA catching up on part of this list. This repo has not diffed all eighteen pages against the September CVE table; that diff is a standing item (§39 rule 2 — a product with many files here is a product whose tab needs the full walk), and the June-25 date is the one to use for any of them a later sweep writes up.

Status stays patched for the Python package (4.6.78 shipped the webhook fix in June; current releases are far past it) with the standing caveat that the platform package and the un-CVE'd June advisories have not been individually verified as fixed.

Update 2026-10-08 — three more of the June-25 tab entries get CVEs on the database (vendor 2026-06-25): a Critical code-injection (CVE-2026-62176, 9.1), the prompt-injection-defence bypass (CVE-2026-61439) and the Crawl4AI SSRF (CVE-2026-61429), all fixed in 4.6.78

Three further PraisonAI rows reached the advisory database's reviewed-critical pip and agent/llm listings on 2026-10-07/08, closing more of the un-CVE'd June-25 tab from the previous update. All were vendor-published 2026-06-25 and fixed in 4.6.78:

• CVE-2026-62176 — code injection via f-string interpolation in Deploy API server generation (praisonai ≤ 4.6.77, GitHub-as-CNA, CVSS 3.1 9.1, CWE-94). deploy/api.py builds Python server code by interpolating the agents_file parameter into an f-string that is then written and run with subprocess.Popen(); an attacker controlling that value (CLI arg, config, or upstream API) injects arbitrary Python. The same pattern appears in deploy/docker.py. Reporter anushkavirgaonkar.
• CVE-2026-61439 — prompt-injection defence bypassed for HIGH-level threats (praisonai ≤ 4.6.77, VulnCheck CNA, CVSS 4.0 8.7 / 3.1 7.5). The Injection Defense layer's default block threshold is CRITICAL (needs 3+ detector families to fire), so a single-vector injection — instruction override, financial manipulation — is logged HIGH but not blocked, enabling prompt extraction, unauthorised tool use or context exfiltration downstream. The fix sets the default to HIGH.
• CVE-2026-61429 — web_crawl SSRF via the Crawl4AI/Chromium backend (praisonaiagents ≤ 1.6.77, VulnCheck CNA, CVSS 3.1 8.5). When crawl4ai + Playwright are installed, web_crawl uses a headless Chromium that resolves DNS and follows redirects with no per-connection SSRF check, so the initial URL check is bypassed through DNS rebinding or redirects (confirmed returning internal content). Extends the earlier PRAI-05 SSRF finding.

These confirm the previous update's read — the ~30-CVE catch-up is the CNA working through the June-25 tab — and none change the Python package's patched status (4.6.78 carries all three). The eighteen-page tab diff remains the standing item.

Update 2026-10-09 — the rest of the June-25 tab reaches the advisory database on 2026-10-07/08: AICoder file-write and command execution (CVE-2026-61445, 9.9), CodeAgent runs model-written Python unsandboxed with the whole environment (CVE-2026-61447, 10.0), the find -exec allowlist bypass (CVE-2026-61434, 8.8), MCP HTTP-stream and Jobs API unauthenticated by default (CVE-2026-61427, CVE-2026-60091), AgentOS no-auth on all interfaces in the npm package (CVE-2026-61426, 8.6), and ten more

The database reviewed the remaining June-25 vendor advisories on 2026-10-07 and 10-08; the agent, llm and reviewed-critical pip listings carried sixteen PraisonAI rows between them. VulnCheck had assigned the CVE ids on 2026-07-11 for the entries it coordinates. All are vendor-dated 2026-06-25; nothing here is new exploitation, only new scanner visibility. The six opened in full:

• CVE-2026-61445 — AICoder arbitrary file write and command execution via LLM tool calls (praisonai ≤ 4.6.77 → 4.6.78; GitHub 9.9, VulnCheck CVSS 4.0 9.4; CWE-22/78). The AICoder UI gives the model write_to_file and execute_command tools with no path validation (an absolute path overrides the working directory through os.path.join) and no command sanitisation; a crafted chat message writes to SSH authorized_keys or a crontab and runs shell commands, and the Docker image runs as root. Reporter anushkavirgaonkar.
• CVE-2026-61447 — CodeAgent executes LLM-generated code without sandboxing and leaks all environment secrets (praisonaiagents ≤ 1.6.77 → 1.6.78; 10.0 on both GitHub and VulnCheck; CWE-94/200). CodeAgent._execute_python() runs model-written Python in a subprocess that inherits the parent environment, with no AST check, no import restriction, and the sandbox setting in CodeConfig ignored even when enabled. The VulnCheck record's "before 1.6.78" is the praisonaiagents version line, not a typo for 4.6.78; the two packages number independently. Reporter anushkavirgaonkar.
• CVE-2026-61434 — shell command allowlist bypass via find -exec (praisonai ≤ 4.6.77 → 4.6.78; 8.8). The earlier fixes blocked metacharacters and used shell: false, but find stayed allowlisted and its -exec, -execdir and -delete actions run programs or remove files with the + terminator, no ; needed; the same gap exists in the TypeScript shell() and SandboxExecutor and the Python safe_shell and sandbox_executor. The same class as the VTCode, Mistral Vibe and Claude Code find bypasses. Reporter HiyokoSauna37.
• CVE-2026-61427 — MCP HTTP-stream transport unauthenticated by default (praisonai ≤ 4.6.77 → 4.6.78; 7.3). Authentication applies only when --api-key is set, and the CLI defaults it to None, so any client can initialise a session and list about 50 tools; tool-call arguments are not checked against the advertised schema. The reporter found workflow.run failing before execution on 4.6.63 and confirmed no unauthenticated RCE or file read in that version; default bind is loopback. Reporter dinhvaren.
• CVE-2026-60091 — Jobs API unauthenticated by default with attacker-controlled webhook SSRF (praisonai ≤ 4.6.77 → 4.6.78; 7.2). The API-key middleware is enabled only when PRAISONAI_JOBS_API_KEY is set; POST /api/v1/runs takes a webhook_url whose host is validated once and resolved again at connect time, a DNS-rebinding TOCTOU that reaches internal services blind, and job results go to whatever URL was supplied. Reporter dinhvaren.
• CVE-2026-61426 — AgentOS defaults to network-exposed no-auth mode (npm praisonai < 1.7.3; 8.6). The TypeScript server binds all interfaces with no API key and a wildcard CORS policy with credentials, so a quickstart deployment exposes an endpoint that returns agent names, roles and system prompts and one that invokes the agent. Reporter dinhvaren.

Also on the listings, from the same vendor date, opened only as rows: CVE-2026-61433 (deploy code generator embeds unescaped YAML in Python source, High), CVE-2026-61435 (Call API localhost-only auth bypass via spoofed Host, High), CVE-2026-61437 (unsafe dynamic module loading via tools.py in AgentFlow, High), CVE-2026-61443 (SkillTools runs scripts without path containment, High), CVE-2026-61431 and CVE-2026-61432 (ContextGatherer and FastContext read outside the workspace, Moderate), CVE-2026-60088 (custom command templates read outside-workspace files into prompts, Moderate), CVE-2026-60090 (PGVector and Cassandra stores interpolate vector dimensions into DDL, Moderate), and CVE-2026-61440 / CVE-2026-61442 (praisonai-platform member routes rewrite labels and reassign leads, Moderate/High). The remediation does not change: praisonai 4.6.78+, praisonaiagents 1.6.78+, npm praisonai 1.7.3+ (PyPI shows 4.7.13 and 1.7.11 current on 2026-10-09), authentication on every transport, and no CodeAgent or AICoder on a host that holds real credentials.

Sources

• NVD — CVE-2026-57124 (PraisonAI unauthenticated MCP-connect RCE) — fetched 2026-09-16 via the NVD API; CVSS 9.8, GHSA-p75f-6fp4-p57w, fixed 4.6.59, one of the ~30-CVE 2026-09-14/15 batch confirmed against the NVD keyword query.
• NVD — CVE-2026-57125 (PraisonAI unauthenticated Jobs API RCE) — fetched 2026-09-16 via the NVD API; CVSS 9.8, fixed praisonai 4.6.59 / praisonaiagents 1.6.59.
• NVD — CVE-2026-57147 (praisonai_platform default JWT secret) — fetched 2026-09-16 via the NVD API; CVSS 9.8, public dev-secret-change-me HS256 key, fixed platform 0.1.6.
• Sysdig — CVE-2026-44338: PraisonAI authentication bypass in under 4 hours and the growing trend of rapid exploitation
• The Hacker News — PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of Disclosure
• SecurityWeek — Hackers Targeted PraisonAI Vulnerability Hours After Disclosure
• CSO Online — PraisonAI vulnerability gets scanned within 4 hours of disclosure
• Cybersecurity News — PraisonAI Vulnerability Exploited Within Hours of Public Disclosure
• GBHackers — PraisonAI Vulnerability Actively Exploited Within Hours of Being Made Public
• GitHub Advisory — GHSA-6rmh-7xcm-cpxj (CVE-2026-44338)
• GitHub Advisory — GHSA-9mqq-jqxf-grvw (CVE-2026-44336 MCP path-traversal .pth injection)
• NVD — CVE-2026-44336
• Snyk — SNYK-PYTHON-PRAISONAI-CVE-2026-44336
• GitHub Advisory — CVE-2026-47418 praisonai-platform cross-workspace IDOR
• GitHub Advisory — CVE-2026-47408 praisonai-platform unauthenticated A2A tool execution

• 2026-10-07 update sources — GitHub Advisory Database — GHSA-7c92-x8vg-4258 / CVE-2026-61436 and GHSA-qj9c-59p6-8cgx / CVE-2026-61428 (fetched 2026-10-07: vendor date 2026-06-25, ≤ 4.6.77 → 4.6.78, the Svix-header and allow/block-list descriptions, reporters); CVE Services — CVE-2026-61436 and CVE-2026-61428 (VulnCheck CNA, 2026-07-15 / 2026-07-11, scores and fix commits) and CVE-2026-62179 (GitHub-as-CNA, 2026-10-07, praisonai-platform < 0.1.9, 6.5); MervinPraison/PraisonAI — Security Advisories, pages 1–2 (walked 2026-10-07: 18 pages; the twenty 2026-06-25 titles summarised above); GitHub Advisory Database — agent recency listing (where the three rows surfaced, 2026-10-07).

• 2026-10-08 update sources — MervinPraison/PraisonAI — GHSA-g6j7-pffp-8whg / CVE-2026-62176, GHSA-fj8f-m44g-c479 / CVE-2026-61439, GHSA-6g59-gm2v-qhvq / CVE-2026-61429 (fetched 2026-10-08: vendor-published 2026-06-25, ≤ 4.6.77 / ≤ 1.6.77 → 4.6.78, scores, mechanisms and reporters); CVE Services — CVE-2026-62176 (GitHub-as-CNA 2026-10-07, 9.1), CVE-2026-61439 and CVE-2026-61429 (VulnCheck CNA 2026-07-11); GitHub Advisory Database — reviewed critical pip listing (fetched 2026-10-07).

• 2026-10-09 update sources — GitHub Advisory Database — GHSA-9mp3-24cc-77mg / CVE-2026-61445, GHSA-2xv2-w8cq-5gxw / CVE-2026-61447, GHSA-cv3g-hj65-pcfh / CVE-2026-61434, GHSA-hc5v-gxvj-58wh / CVE-2026-61427, GHSA-4w49-gwv8-fpjg / CVE-2026-60091, GHSA-6wjp-v33h-5cvq / CVE-2026-61426 (all fetched 2026-10-09: repository date 2026-06-25, database 2026-10-08, ranges, scores, mechanisms, reporters); CVE Services — CVE-2026-61445 and CVE-2026-61447 (VulnCheck CNA, 2026-07-11; 4.0 9.4 / 3.1 9.9 and 10.0 / 10.0); MervinPraison/PraisonAI — Security Advisories pages 1–2 (re-walked 2026-10-09; twenty entries dated 2026-06-25); GitHub Advisory Database — agent listing, llm listing and reviewed critical pip listing (the rows, 2026-10-09); pip index versions praisonai / praisonaiagents (4.7.13 / 1.7.11, 2026-10-09).