Missing access control in PraisonAI AgentTeam exposes agent endpoints
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.
Summary
PraisonAI before 4.6.59 and praisonaiagents before 1.6.59 register agent routes through AgentTeam.launch without authentication or authorization checks (CWE-306). A remote client that reaches an exposed server can list agents and invoke them without credentials. The attacker can consume model resources, access connected private context, and trigger agent tools or workflow side effects.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MervinPraison | PraisonAI | before 4.6.59 | 4.6.59 | Patch available | CNA |
| MervinPraison | praisonaiagents | before 1.6.59 | 1.6.59 | Patch available | CNA |
| — | praisonaiagents (PyPI) | before 1.6.59 | 1.6.59 | Patch available | GHSA-x8cv-xmq7-p8xp |
- PraisonAI VendorMervinPraison Affected before 4.6.59 Fixed in 4.6.59 Patch available CNA
- praisonaiagents VendorMervinPraison Affected before 1.6.59 Fixed in 1.6.59 Patch available CNA
- praisonaiagents (PyPI) Vendor— Affected before 1.6.59 Fixed in 1.6.59 Patch available GHSA-x8cv-xmq7-p8xp
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* | — | — | MervinPraison |
- cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions — — ·MervinPraison
Remediation
Upgrade praisonaiagents to 1.6.59, which fixes this flaw. The sources list no fixed version for PraisonAI.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA PraisonAI (MervinPraison) Fixed in 4.6.59
- Fix · CNA praisonaiagents (MervinPraison) Fixed in 1.6.59
- Fix · GHSA-x8cv-xmq7-p8xp praisonaiagents (PyPI) Fixed in 1.6.59 Advisory →
Timeline
- 2026-10-12 Threatist record created from CVE-2026-57118
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Priority changed: MEDIUM → HIGH
References
More MervinPraison vulnerabilities
- TI-2026-79619 Missing authentication in PraisonAI AgentOS exposes agent chat CVSS 3.1CRITICAL 9.8
- TI-2026-44052 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent CVSS 4.0CRITICAL 10.0
- TI-2026-41123 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) CVSS 3.1CRITICAL 9.8
- TI-2026-41122 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery CVSS 3.1CRITICAL 9.8
- TI-2026-41118 PraisonAI MCPServer exposes unauthenticated HTTP tools/call CVSS 3.1CRITICAL 9.8
- TI-2026-41110 praisonai: Jobs API exposes agent-execution endpoints with no authentication CVSS 3.1CRITICAL 9.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences