PraisonAI: Missing authentication in AgentTeam.launch agent endpoints
Summary
PraisonAI is a multi-agent teams system. In affected versions, the AgentTeam.launch server and the Agents alias register HTTP endpoints for listing agents and calling agent.chat without any access-control checks. A network-reachable server allows unauthenticated clients to enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. No user interaction or credentials are required.
Affected
- praisonaiagents (Python package) before 1.6.59
- PraisonAI before 4.6.59 (per CVE record)
- The GHSA affected-range field lists 4.6.57 and below; the version mapping is inconsistent across sources.
Fixed in
- praisonaiagents 1.6.59 or later
- PraisonAI v4.6.59 (release tag, fix commit b4270173d4123fb1ee8910588f0896668ee21b59)
Workaround
Unknown. The vendor does not state an interim workaround.
- Do not expose AgentTeam.launch servers beyond localhost.
- Block the port at the firewall and place remote access behind an authenticating reverse proxy or VPN.
- Stop servers that are not needed and review which tools and data each agent can reach.
Exploitation
- CISA SSVC: exploitation PoC, automatable yes, technical impact total.
- The GHSA advisory includes a reproduction script for unauthenticated access; VulDB reports no exploit available.
- Not listed in CISA KEV. No observed attacks reported.
Our recommendation
- Check the installed praisonaiagents version (pip show praisonaiagents) and the praisonai package, if used.
- Upgrade to praisonaiagents 1.6.59 or later.
- Check whether any agent server is reachable from outside the company network or from untrusted internal networks and restrict access immediately.
- Monitor logs for unexpected requests to the agent list and agent invocation endpoints.
- Review the tools and connected data that exposed agents can use.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA advisory GHSA-x8cv-xmq7-p8xp github.com
- Fix commit b4270173 github.com
- Release v4.6.59 github.com
- OSV PYSEC-2026-3537 osv.dev
- OpenCVE CVE-2026-57118 app.opencve.io
- VulDB 417190 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:12.
Original description (NVD)
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.
NVD references (4)
- https://github.com/MervinPraison/PraisonAI/commit/b4270173d4123fb1ee8910588f0896668ee21b59
- https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x8cv-xmq7-p8xp
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x8cv-xmq7-p8xp
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.