# CVE-2026-40151: PraisonAI AgentOS unauthenticated information disclosure in /api/agents

Source: https://junglewise.ai/threats/cve-2026-40151-praisonai-agentos-unauthenticated-information-disclosure-in-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40151 · Severity: medium · CVSS 5.3 · Published 2026-04-09

PraisonAI is a platform for deploying AI agents. A security flaw in its AgentOS component allows anyone on the network to view sensitive configuration details, including agent names, roles, and parts of their internal instructions. This could expose proprietary business logic, internal API locations, or other confidential operational data to unauthorized parties.

Technologies: [Praisonai](https://junglewise.ai/threats/technologies/praisonai), [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai). Vendors: [Praison](https://junglewise.ai/threats/vendors/praison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-40151 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40151 being exploited in the wild.

**How severe is CVE-2026-40151?** Medium severity, with a CVSS score of 5.3, published 9 April 2026.

**Which products and versions are affected?** praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.128.

**Is there a fix for CVE-2026-40151?** Yes. praisonai (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40151 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40151?** Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonai (PyPI): upgrade to 4.5.128 or later

  ```sh
  pip install "praisonai>=4.5.128"
  ```


## Technical details

The AgentOS component in PraisonAI fails to implement authentication middleware or API key validation for its FastAPI-based web server. The `GET /api/agents` endpoint returns agent metadata and the first 100 characters of system instructions to any unauthenticated requester. Furthermore, the application defaults to a wildcard CORS policy (`allow_origins=["*"]`) and binds to all interfaces (`0.0.0.0`), enabling cross-origin exfiltration from a user's browser. While the endpoint truncates instructions, an attacker can chain this with the unauthenticated `/api/chat` endpoint to extract full system prompts via prompt injection. This issue was addressed in version 4.5.128.

## Affected products

- MervinPraison PraisonAI < 4.5.128

## Identifiers

- CVE-2026-40151
- GHSA-pm96-6xpr-978x
- PYSEC-2026-2919

## Timeline

- 2026-04-09: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 4.5.128

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [PraisonAI authentication bypass in A2U event streaming](https://junglewise.ai/threats/cve-2026-57146-praisonai-a2u-incomplete-authentication-fix-leaves-current-serve)
- [PraisonAI sandbox escape when Landlock unavailable](https://junglewise.ai/threats/cve-2026-57144-praisonai-sandlocksandbox-falls-back-to-unrestricted-subprocess)
- [PraisonAI recipe policy bypass via YAML-approved tools](https://junglewise.ai/threats/cve-2026-57142-praisonai-recipe-workflow-policy-can-be-bypassed-by-declaring-and)
- [PraisonAI shell command injection in compute-bridged file tools](https://junglewise.ai/threats/cve-2026-57117-praisonai-compute-bridged-file-tools-allow-shell-command)
- [PraisonAI AgentOS authentication bypass in FastAPI deployment](https://junglewise.ai/threats/cve-2026-57116-praisonai-agentos-remains-unauthenticated-after-incomplete-fix)