PraisonAI AgentOS: Missing authentication allows remote agent invocation

Summary

The AgentOS FastAPI deployment of PraisonAI registers its agent listing and chat routes without any authentication, and the bearer token is not checked. A remote client that can reach the service can list deployed agents, read their names, roles and instruction snippets, and invoke agents. Any tools, private context, memory, API integrations or paid model calls attached to those agents can then be used by the attacker. The default host is 0.0.0.0, so exposure depends on whether the service is reachable from untrusted networks.

Affected

• PraisonAI (pip package praisonai) from 4.2.1 up to but not including 4.6.59
• The npm package with a similar name (CVE-2026-57140) is a separate issue and not covered by this entry

Fixed in

• Upgrade to PraisonAI 4.6.59 or later (fixed version per CVE text; the GitHub advisory's patched-versions field should be verified before rollout)

Workaround

• No vendor workaround published.
• Keep the AgentOS service off untrusted networks, bind it to localhost or an internal interface, and place it behind an authenticated reverse proxy or VPN.
• Review agent tools, memory and API credentials, and set spending limits on model APIs.

Exploitation

• No confirmed exploitation in the wild known at the time of writing.
• The advisory contains a local proof of concept; no public exploit repository was found.
• Related PraisonAI missing-authentication flaws have reportedly been exploited quickly after disclosure, so exposed instances are a realistic target.
• CISA SSVC: exploitation status PoC, automatable yes, technical impact total.

Our recommendation

• Inventory pip installations of praisonai and identify versions 4.2.1 to before 4.6.59.
• Upgrade to 4.6.59 or later and verify the fixed version in the GitHub advisory.
• Until the upgrade is done, restrict network access to the AgentOS port (default 8000) and check for exposed /api/agents and /api/chat routes.
• Review tools and API keys reachable by agents and monitor logs for unauthenticated /api/chat requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-892r-p3jq-jp24 github.com
• OSV GHSA-892r-p3jq-jp24 osv.dev
• Vulners OSV CVE-2026-57116 vulners.com
• Kodem CVE archive CVE-2026-57116 www.kodemsecurity.com
• Endor Labs CVE-2026-57116 www.endorlabs.com
• Strix CVE-2026-57116 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:45.