Skip to content

PraisonAI CVE-2026-44338 rapid exploitation

Summary

Sysdig Threat Research reported that internet-exposed PraisonAI agent-framework deployments were scanned for CVE-2026-44338 within 3 hours and 44 minutes of the GitHub advisory being published on May 11, 2026. The vulnerable legacy api_server.py entrypoint shipped with authentication disabled by default, leaving GET /agents and POST /chat reachable without credentials in affected versions.

On August 25, 2026, a batch of 20 GitHub Security Advisories (CVE-2026-55522 – CVE-2026-55541, GHSA set published 14:05–15:22 UTC) documented the breadth of PraisonAI's security surface: a critical patch bypass of the earlier CVE-2026-40289 fix, unauthenticated remote agent and job execution, SSRF bypasses, path traversal, and file-write flaws — all fixed in PraisonAI 4.6.58 / praisonaiagents 1.6.58. This extends the page's durable finding from "exposed agent frameworks get scanner-validated in hours" to "the framework's authentication model repeatedly fails open across its API, jobs, recipes, and MCP surfaces." See the August 25 advisory wave.

The durable intelligence value is the exploitation latency and target class: even a mid-sized AI-agent framework was folded into same-day known-CVE scanner workflows. The observed scanner did not trigger agent execution during Sysdig's capture, but it successfully validated exposed PraisonAI endpoints and provides a concrete signal for defenders watching internet-facing AI workflow systems.

Tags

Why this matters

  • PraisonAI is an open-source multi-agent orchestration framework; exposed agent runtimes may hold model-provider credentials, cloud credentials, internal data access, or side-effecting tools.
  • Sysdig observed targeted probing less than four hours after public disclosure, reinforcing that advisory-to-exploitation windows for AI and automation tooling should be measured in hours, not days.
  • The vulnerability is not a conventional one-shot RCE by itself. Impact depends on what the operator's agents.yaml workflow can do when /chat invokes the configured agent graph.
  • GET /agents can disclose agent metadata and confirm the target is vulnerable. A later POST /chat can trigger model quota burn, tool execution, file or network actions, downstream workflow calls, or additional information disclosure.
  • The observed activity looked like packaged validation rather than hands-on-keyboard exploitation, which means follow-on exploitation may come from separate tooling or operators after scanner results are collected.

Reported chain

  1. GitHub published advisory GHSA-6rmh-7xcm-cpxj for PraisonAI CVE-2026-44338 at 13:56:16 UTC on May 11, 2026.
  2. Sysdig first saw generic reconnaissance from 146.190.133.49 at 17:32:50 UTC, including common disclosure and application paths.
  3. The same source pivoted to AI-agent and PraisonAI-specific paths at 17:40:53 UTC, including /praisonai/version.txt, /docs, /api/agents/config, /api/agents, and /agents.
  4. A GET /agents request with User-Agent CVE-Detector/1.0 hit the documented vulnerable endpoint at 17:40:55 UTC and returned agent metadata without an Authorization header.
  5. Sysdig observed a second GET /agents probe shortly afterward, but no POST /chat execution attempt in the captured activity.

Vulnerability notes

  • Affected range: PraisonAI >= 2.5.6, <= 4.6.33.
  • Fixed version: 4.6.34.
  • Root issue: the legacy Flask API server hard-coded authentication off (AUTH_ENABLED = False, AUTH_TOKEN = None) and allowed protected routes to fail open.
  • Exposed routes: GET /agents returns configured agent metadata; POST /chat runs PraisonAI(agent_file="agents.yaml").run() regardless of the submitted message value.

Defender heuristics

  • Upgrade PraisonAI to 4.6.34 or later and migrate away from the legacy api_server.py entrypoint.
  • Do not expose PraisonAI or similar agent-framework APIs directly to the internet; bind to loopback or private networks and require an API key or upstream authentication.
  • Hunt for GET /agents or POST /chat requests without Authorization headers, especially when paired with User-Agent CVE-Detector/1.0.
  • Review logs for fingerprinting paths such as /praisonai/version.txt, /pyproject.toml, /poetry.lock, /requirements.txt, /api/agents/config, /api/mcp/config, and OpenAPI/Swagger endpoints.
  • Treat exposed agent frameworks as secret-spill candidates: audit model-provider bills and rotate credentials referenced by agents.yaml, environment files, tool configs, or connected cloud accounts.
  • Add runtime detections for unexpected Python child processes, outbound network connections, file writes, and tool invocations from agent-server processes.

August 25, 2026 advisory wave (CVE-2026-55522 – 55541)

On August 25, 2026, GitHub published a batch of 20 PraisonAI / praisonaiagents security advisories in the CVE-2026-55522 through CVE-2026-55541 range, all with a first patched version of PraisonAI 4.6.58 / praisonaiagents 1.6.58. The breadth of the wave reinforces the page's durable finding: the framework's authentication model fails open across multiple surfaces.

  • Patch bypass (critical): praisonai/browser/server.py WebSocket origin validation uses an unanchored re.match() against chrome-extension://[a-z0-9]{32}, so any Origin with more than 32 trailing characters passes — a bypass of the CVE-2026-40289 fix.
  • Unauthenticated agent/job execution: praisonai serve agents --api-key is parsed but never enforced on POST /agents / POST /agents/{name}; the async Jobs API (/api/v1/runs) installs its router with no authentication middleware at all.
  • Recipe server fail-open: when auth is set to api-key or jwt but the secret is missing, the Recipe HTTP server silently accepts unauthenticated requests.
  • SSRF cluster: web_crawl redirect-following SSRF, spider_tools._host_is_blocked() DNS-rebinding bypass, webhook SSRF via DNS fail-open in JobSubmitRequest.validate_webhook_url(), and a webhook-URL DNS-rebinding bypass.
  • Path traversal / file write: agent tools escape the configured workspace via symlinks; unsanitized user_id in FileMemory allows arbitrary file write; ast_grep_rewrite rewrites arbitrary files without the @require_approval gate.
  • Other: workflow include bypasses the tools.py autoload opt-in and executes included recipe code; Browser Server WebSocket origin bypass; MCP HTTP stream origin validation bypass; unauthenticated unbounded MCP session accumulation.

Defender note: upgrading to 4.6.58 / 1.6.58 addresses all 20 findings; treat pre-4.6.58 internet-exposed PraisonAI deployments as already-fingerprinted by the same scanner class observed for CVE-2026-44338.

Sources