What is the CVSS score of CVE-2026-44338?

CVE-2026-44338 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PraisonAI are affected by CVE-2026-44338?

PraisonAI versions 2.5.6 through 4.6.33 expose a critical authentication bypass in the Flask API server that allows unauthenticated remote attackers to execute arbitrary agent workflows and access…. A patch is available.

Is there a public PoC exploit available for CVE-2026-44338?

Yes, a public proof-of-concept exploit is available for CVE-2026-44338. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-44338?

Within 24 hours: Identify all PraisonAI deployments and determine installed versions (check /agents or /chat endpoint responses for version identifiers; audit internal asset inventory). Within 7 days: Upgrade to PraisonAI version 4.6.34 or later; if immediate upgrade is not feasible, implement network segmentation to restrict access to Flask API ports (default 5000) to trusted internal networks only. Within 30 days: Conduct post-upgrade validation testing; audit workflow execution logs for suspicious /chat and /agents API calls during the vulnerable window; review agent configurations in agents.yaml for unauthorized modifications.

PraisonAI CVE-2026-44338

EUVD-2026-28641 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-05-08 security-advisories@github.com

GHSA-6rmh-7xcm-cpxj

Authentication Bypass Python

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 08, 2026 - 15:17 EUVD

Analysis Generated

May 08, 2026 - 15:00 vuln.today

CVE Published

May 08, 2026 - 14:16 nvd

HIGH 7.3

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.

AnalysisAI

Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workflows without authentication. Versions 2.5.6 through 4.6.33 ship with authentication disabled by default on the Flask server, enabling any network-accessible caller to trigger agents.yaml workflows via the /chat endpoint and access agent configurations through /agents. Patch released in version 4.6.34. CVSS 7.3 with network vector and no privileges required (AV:N/AC:L/PR:N/UI:N) indicates this is remotely exploitable against default configurations, though impact is limited to low confidentiality, integrity, and availability (C:L/I:L/A:L).

Technical ContextAI

PraisonAI is a Python-based multi-agent orchestration system that includes a legacy Flask API server for agent workflow management. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), where the Flask server's authentication mechanism is disabled by default in affected versions. The /agents endpoint exposes agent configuration data, while /chat serves as the execution trigger for workflows defined in agents.yaml files. This represents a fundamental access control failure where critical API endpoints lack authentication enforcement, allowing anonymous access to agent orchestration capabilities. The Flask framework itself is not vulnerable-the issue lies in PraisonAI's implementation choice to disable authentication by default on a production-capable API server.

RemediationAI

Upgrade to PraisonAI version 4.6.34 or later, which patches the authentication bypass by enabling authentication by default on the Flask API server. For organizations unable to upgrade immediately, implement network-level access controls to restrict Flask API server access to trusted sources only-use firewall rules to block external access to the Flask server port, deploy behind a reverse proxy with enforced authentication (such as nginx with HTTP Basic Auth or OAuth2 proxy), or bind the Flask server to localhost (127.0.0.1) if only local access is required. If the legacy Flask server is not actively used, disable it entirely and migrate to alternative PraisonAI API implementations if available. Note that network restrictions are temporary mitigations-they do not fix the underlying authentication failure and remain vulnerable to internal threats or network boundary bypasses. Review agent workflow configurations in agents.yaml to assess potential impact of unauthorized execution, and audit logs for evidence of unauthorized /chat or /agents endpoint access prior to patching. Consult the GitHub advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6rmh-7xcm-cpxj for vendor-specific guidance.