PraisonAI CVE-2026-44338

Flask API server must be network-accessible to the attacker (exposed to internet, reachable from attacker's network position, or accessible via compromised internal host). The legacy Flask server specifically must be in use-if the deployment uses alternative PraisonAI API implementations or has the Flask server disabled, the vulnerability does not apply. Default configuration where authentication is disabled must be present-if administrators manually enabled authentication mechanisms, exploitation is prevented. Active agents.yaml workflow configuration must exist for /chat exploitation to have meaningful impact, though /agents reconnaissance works regardless. Exploitation does NOT require: user interaction, valid credentials, non-default configurations, or specific client software. The AV:N/AC:L/PR:N/UI:N vector confirms no special conditions beyond network reachability. Limiting factors are deployment architecture (not all PraisonAI installations may use the Flask server) and network segmentation (air-gapped or localhost-only bindings prevent remote exploitation).

Real-world risk is moderate despite the 7.3 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation with low complexity, making this trivially exploitable if the Flask server is network-accessible. However, the low impact ratings (C:L/I:L/A:L) suggest constrained damage-attackers can trigger agent workflows and read configurations but may not achieve full system compromise depending on what those agents do. No EPSS score, KEV listing, or public POC data provided, suggesting exploitation has not been observed in the wild and attack tooling may not be widely available. The security advisory from GitHub (GHSA-6rmh-7xcm-cpxj) indicates responsible disclosure. Critical risk factors are deployment-dependent: organizations exposing this Flask API to the internet or untrusted networks face immediate risk, while those using it only in isolated development environments have lower exposure. The 'legacy' designation suggests this server may not be the default deployment method in current versions, which could naturally limit the attack surface. Priority should be HIGH for production deployments with network-exposed Flask servers, MEDIUM for internal-only deployments where lateral movement is a concern.

An attacker scans the internet for exposed PraisonAI Flask servers (default ports or common proxy configurations) and identifies instances running vulnerable versions. Without authentication, the attacker accesses the /agents endpoint to enumerate configured agent workflows and their capabilities, then crafts malicious input to the /chat endpoint to trigger arbitrary agent execution. Depending on agent configurations, this could enable data exfiltration, unauthorized AI model access consuming organizational resources, or manipulation of agent outputs to inject misinformation into downstream systems. No specialized tooling required-standard HTTP clients suffice for exploitation.