CVE-2026-57140: PraisonAI AgentOS unauthenticated agent listing and invocation

CVE-2026-57140 · Severity: critical · CVSS 9.4 · Published 2026-09-15

PraisonAI's npm package ships a multi-agent framework with an HTTP server that listens on all network interfaces by default and exposes sensitive agent APIs without requiring authentication. An attacker with network access can read agent names, roles, and instruction details, and invoke agents to execute tasks without any credentials. This could allow unauthorized access to business data, external APIs, and system resources that deployed agents can reach.

Vendors: PraisonAI.

Quick answers

Is CVE-2026-57140 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57140 being exploited in the wild.
How severe is CVE-2026-57140?
Critical severity, with a CVSS score of 9.4, published 15 September 2026.
Which products and versions are affected?
PraisonAI AgentOS >=1.6.0, <=1.7.1.
Is there a fix for CVE-2026-57140?
A patch was published on 2026-06-17: Patched in version 1.7.2+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57140 attacked?
It is attacked over the network.
Am I affected by CVE-2026-57140?
Check whether you run PraisonAI AgentOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The npm praisonai package implements a TypeScript-based AgentOS HTTP server that binds to 0.0.0.0 by default and exposes sensitive routes via Express.js without authentication middleware. The GET /api/agents endpoint discloses agent names, roles, and instruction prefixes, while the POST /api/chat endpoint allows direct agent invocation with user-supplied messages. The root cause is the absence of authentication and authorization middleware between request parsing and route registration; AgentOSConfig lacks any authentication token or authorization callback configuration. An unauthenticated network attacker can enumerate agents and execute prompt injection attacks through /api/chat to influence agent behavior and access downstream systems, credentials, and business data accessible to the deployed agents. The vulnerability is patched in version 1.7.2 and later by adding bearer-token authentication middleware.

Affected products

  • PraisonAI AgentOS >=1.6.0, <=1.7.1

Identifiers

  • CVE-2026-57140
  • GHSA-9752-mhqh-h34f

Timeline

  • 2026-06-18: disclosed
  • 2026-06-17: patched: Patched in version 1.7.2+

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.