How to fix or mitigate CVE-2026-56076?

Within 24 hours: Inventory all systems running PraisonAI and determine which expose the AGUI endpoint to the network; audit stored environment variables and credentials for exposure risk. Within 7 days: Implement network-level access controls restricting AGUI endpoint access to explicitly trusted networks only; disable AGUI functionality if not in active use. Within 30 days: Monitor PraisonAI vendor advisories for security updates; rotate all credentials that may have been exposed; establish persistent monitoring for unauthorized AGUI endpoint access patterns.

PraisonAI CVE-2026-56076

Q: What is the CVSS score of CVE-2026-56076?

CVE-2026-56076 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

Q: Which versions of PraisonAI are affected by CVE-2026-56076?

PraisonAI's AGUI endpoint contains a cross-origin vulnerability allowing any attacker-controlled website to silently invoke locally-running agents and exfiltrate their responses, including sensitive…. A patch is available.

EUVD-2026-37960 HIGH

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-06-18 VulnCheck

GHSA-5fr5-2c3f-3fcr

Cors Misconfiguration RCE Praisonai

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable endpoint with no auth (AV:N, PR:N); victim must browse attacker page (UI:R); agent execution and data read yield C:H/I:H; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 19, 2026 - 02:01 EUVD

Source Code Evidence Fetched

Jun 18, 2026 - 23:17 vuln.today

Analysis Generated

Jun 18, 2026 - 23:17 vuln.today

DescriptionCVE.org

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, combined with Starlette's Content-Type-agnostic JSON parsing, enabling attackers to bypass CORS preflight checks via simple requests and exfiltrate sensitive agent responses including tool execution results and environment data.

AnalysisAI

Cross-origin agent execution in PraisonAI's AGUI endpoint allows any attacker-controlled website to silently invoke locally-running agents and exfiltrate their streaming responses, including tool execution results and sensitive environment data. The flaw stems from a triad of issues - no authentication on POST /agui, a hardcoded wildcard CORS header, and Starlette's Content-Type-agnostic JSON parsing - that together let a simple cross-origin request bypass the browser's preflight check. No public exploit identified at time of analysis, but the GHSA advisory publishes a complete attack flow making weaponization trivial.

Technical ContextAI

PraisonAI is an open-source multi-agent framework distributed as the praisonaiagents pip package; the affected component is src/praisonai-agents/praisonaiagents/ui/agui/agui.py, which exposes a FastAPI/Starlette router intended for local UI integration. The root cause is CWE-942 (Permissive Cross-domain Policy with Untrusted Domains): the StreamingResponse hardcodes Access-Control-Allow-Origin: *, the route has no auth dependency, and Starlette's Request.json() does not validate Content-Type, so a browser POST with text/plain qualifies as a CORS 'simple request' that skips the preflight OPTIONS gate. Because the response body is also wildcard-readable, attacker JavaScript can both trigger the agent and read the full SSE stream containing tool outputs and environment-derived data. CPE coverage is cpe:2.3:a:praisonai:praisonai:*:*:* with no upper bound enumerated in NVD.

RemediationAI

Vendor-released patch: praisonaiagents 4.5.128 (also referenced as PraisonAI 1.5.128 in the NVD entry) - upgrade via pip install --upgrade praisonaiagents>=4.5.128 per GHSA-x462-jjpc-q4q4 at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x462-jjpc-q4q4. Until the upgrade is applied, place the AGUI server behind a reverse proxy that strips and replaces the wildcard Access-Control-Allow-Origin header with an explicit allowlist of trusted UI origins, and add an authenticating middleware (bearer token or session cookie with SameSite=Strict) in front of POST /agui; both changes are needed because either alone leaves the browser-trust gap open. As an interim host-level control, bind the AGUI listener exclusively to a loopback interface unreachable from the browser's outbound JS (e.g., a Unix domain socket or a non-localhost private interface accessed via SSH tunnel), accepting that this breaks browser-based UI clients that expect http://localhost:8000.