Executive brief
PraisonAI, a framework for managing AI agents, contains a security flaw where its server component is accessible to anyone on the network by default without a password. An unauthorized person could connect to the service to steal sensitive AI system prompts or interact with the AI agents, potentially leading to unauthorized data access or unexpected financial costs from AI usage. This issue affects users who deployed the software using the default settings in versions prior to 1.7.3.
Technical details
The AgentOS server in the PraisonAI TypeScript/npm package implements an insecure default configuration in `src/praisonai-ts/src/os/config.ts`. By default, the server binds to 0.0.0.0, sets an empty API key, and enables wildcard CORS with credentials. The authentication middleware in `src/praisonai-ts/src/os/agentos.ts` is only registered if a non-empty API key is provided, leading to a 'fail-open' state when no key is configured. Remote unauthenticated attackers can access `GET /api/agents` to leak system prompts and `POST /api/chat` to trigger agent execution. The vulnerability is addressed in version 1.7.3 by requiring authentication and changing default binding behavior.
Affected products
- MervinPraison PraisonAI < 1.7.3
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-11: disclosed: NVD publication date