PraisonAI AgentOS EUVD-2026-108894

Exploitation requires that an operator actually run AgentOS or the AgentApp alias and expose it on a network-reachable interface - which the default configuration encourages, since AgentOSConfig/AgentAppConfig default host to 0.0.0.0 (all interfaces) with no authentication fields. No special feature flag, user interaction, or credentials are needed: both no-auth and wrong-bearer requests to GET /api/agents and POST /api/chat succeed against the default configuration (PR:N, unauthenticated). The main factors that LIMIT real-world impact are: (1) the endpoint must be reachable (an instance kept on loopback or behind an authenticating proxy is not exposed), and (2) the severity of what the attacker can achieve scales with the deployed agents' capabilities - agents wired to tools, private context, memory, external API integrations, browser actions, or paid model calls enable data exfiltration, side effects, and budget exhaustion, whereas a minimal no-tool agent yields mainly metadata disclosure and invocation.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the advisory's mechanism: AgentOS/AgentApp registers GET /api/agents and POST /api/chat with no middleware, dependency, API-key, or bearer check, and defaults its bind host to 0.0.0.0, so a network-reachable, unauthenticated client can both enumerate agents and invoke agent.chat(). The vuln.today Decision label is act_now, which - combined with an incomplete-fix situation where the previously 'patched' v4.5.128 and the latest release v4.6.57 both still reproduce - raises urgency: operators who believed they were fixed by GHSA-pm96-6xpr-978x / CVE-2026-40151 are not. The main tempering factors are deployment-dependent: the advisory itself states the real impact scales with what the deployed agents are wired to (tools, private context, memory, API integrations, cost-bearing model calls); a bare no-tool demo agent would warrant a lower score, as the reporter acknowledges. Signals that are MISSING rather than conflicting: no EPSS score was provided (exploitation-probability cannot be weighed), and there is no CISA KEV listing, so there is no evidence of active exploitation - only a demonstrated, reproducible flaw. The confidentiality-focused CWE-200 tag understates the issue; the advisory assigns CWE-306 (missing authentication) and CWE-862 (missing authorization), reflecting unauthorized agent invocation beyond passive metadata disclosure.

An operator deploys a PraisonAI AgentOS/AgentApp instance that, by default, binds to 0.0.0.0 with no authentication, exposing it on a reachable interface. An unauthenticated attacker calls GET /api/agents to enumerate agent names, roles, and instruction snippets, then issues POST /api/chat requests (with no Authorization header, or an arbitrary wrong bearer token, both of which succeed) to drive the agent - triggering its attached tools, memory reads, and API integrations. A public PoC reference exists: the GHSA advisory includes a local in-process FastAPI TestClient reproducer and a version sweep, though it is not verified as a working remote network exploit.