PraisonAI AgentTeam missing authentication in launch endpoints

Executive brief

PraisonAI is a framework for building and deploying AI agent teams. A vulnerability in the AgentTeam.launch() function allows anyone with network access to list and interact with these AI agents without any authentication. This could allow unauthorized users to trigger expensive AI model calls, access private data used by the agents, or execute actions through tools and integrations connected to the agents.

Technical details

The AgentTeam.launch() and Agents.launch() methods in the praisonaiagents package initialize a FastAPI server that lacks authentication middleware or token validation. The server registers GET /{path}/list, POST /{path}, and POST /{path}/{agent_id} routes which directly invoke the agent.chat() method. By default, the server binds to 0.0.0.0, making it reachable over the network. An attacker can send unauthenticated requests to these endpoints to enumerate agents and trigger agent execution, potentially leading to unauthorized tool use, data exfiltration from agent memory, or resource exhaustion. This issue was addressed in version 1.6.59 by implementing authentication requirements.

Affected products

• MervinPraison/PraisonAI praisonaiagents < 1.6.59

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D