PraisonAI Agents CVE-2026-57118

Exploitation requires that the target runs the Python AgentTeam.launch() or its Agents.launch() alias to start the FastAPI HTTP server, and that this server is network-reachable - the default bind host is 0.0.0.0 and official documentation demonstrates host='0.0.0.0' for remote access, so a standard remote deployment is sufficient. Once the server is up, no authentication is enforced: requests with no Authorization header or an incorrect bearer token are accepted on GET /{path}/list, POST /{path}, and POST /{path}/{agent_id}. The principal limiting factor is purely deployment-based - if the launch() server is not started or is bound only to localhost/placed behind an authenticating proxy, the vulnerable routes are not externally exploitable. No user interaction, authentication, or non-default feature toggle is otherwise required.

All signals converge on a genuinely high-priority flaw rather than an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the description and CWE-306 (Missing Authentication for Critical Function): the GHSA advisory confirms that GET /{path}/list, POST /{path}, and POST /{path}/{agent_id} accept requests with no Authorization header - and even with an obviously wrong bearer token - before invoking agent.chat(). The C:H/I:H/A:H impact is well-supported: unauthenticated callers can read connected private context (confidentiality), trigger agent tools and workflow side effects (integrity), and consume model/API resources (availability/cost). The one tempering factor is deployment-dependent exploitability: the vulnerable surface only exists when AgentTeam.launch()/Agents.launch() is actually started and reachable, though the default bind of 0.0.0.0 and official docs showing host='0.0.0.0' make remote exposure a realistic default. No EPSS score, no CISA KEV listing, and no public proof-of-concept were supplied in the input, so there is currently no evidence of active or widespread exploitation despite the critical score - treat this as high-priority-to-patch but not confirmed-under-attack. The advisory explicitly frames this as an incomplete-fix/sibling variant of a prior PraisonAI unauthenticated-server advisory family, which raises the likelihood that exposed instances exist in the wild.

An operator deploys a PraisonAI agent team using Agents.launch() on host 0.0.0.0, exposing the FastAPI endpoints to a network or the internet. An unauthenticated attacker sends GET /{path}/list to enumerate the deployed agents, then issues POST /{path}/{agent_id} with a crafted query to invoke a specific agent, reading its connected private context and triggering its tools. No public proof-of-concept was identified in the provided data, but the attack requires only standard HTTP requests against default configuration.