Praisonai CVE-2026-40151

This vulnerability presents moderate real-world risk despite a CVSS base score of 5.3 (low-to-moderate). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a low-barrier network attack requiring no privileges or user interaction, but impact is confined to confidentiality (C:L) with no integrity or availability impact. However, the practical risk depends on deployment context: if AgentOS instances are internet-facing (default binding to 0.0.0.0 with permissive CORS), reconnaissance becomes trivial and information leaked may enable targeted attacks on downstream systems. The vulnerability is not a direct code execution or service disruption vector, but information disclosure of agent configurations can facilitate secondary attacks (e.g., prompt injection targeting identified agents, social engineering using exposed roles). No CISA KEV status or public proof-of-concept availability was provided; this is a discovery via vendor security advisory (GitHub GHSA), not confirmed active exploitation. For organizations running isolated or properly firewalled AgentOS deployments, risk is lower; for cloud-exposed or multi-tenant scenarios, the lack of authentication is a critical security posture deficiency.

An attacker scans for internet-exposed AgentOS instances (default binding to 0.0.0.0 makes them discoverable). Upon finding an instance, the attacker sends an unauthenticated HTTP GET request to /api/agents and receives a JSON response listing all agent names, roles, and the first 100 characters of their system instructions. The attacker uses this reconnaissance to identify high-value agents (e.g., 'financial-advisor', 'internal-api-gateway') and crafts prompt injection payloads or social engineering strategies targeted at those specific agents' roles. No authentication credential is required; network access alone is sufficient. While no public proof-of-concept exploit code was identified, the attack is trivial to execute given the simplicity of HTTP enumeration.