PraisonAI AgentOS unauthenticated remote agent invocation

Executive brief

PraisonAI is a framework for deploying AI agents. A vulnerability in its AgentOS component allows anyone on the network to interact with deployed AI agents without any authentication. This could allow unauthorized individuals to trigger agent actions, access private data the agents are connected to, or incur significant costs by making the agents perform expensive AI tasks.

Technical details

The AgentOS and AgentApp components in PraisonAI fail to implement authentication checks for the '/api/agents' and '/api/chat' endpoints. The root cause is a lack of middleware or dependency-based security in the '_register_routes' method of the AgentOS class, combined with a default configuration that binds to all network interfaces (0.0.0.0). An attacker can send unauthenticated POST requests to the chat endpoint to execute agent logic, including any tools or API integrations the agent possesses. This issue persists despite a previous attempt to fix similar behavior in CVE-2026-40151. A patch is available in version 4.6.59.

Affected products

• MervinPraison praisonai >= 4.2.1, <= 4.6.57

Timeline

• 2026-06-17: disclosed
• 2026-06-17: advisory: GHSA-892r-p3jq-jp24 published
• 2026-06-18: patched: Version 4.6.59 released

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D