EUVD-2026-21172
GHSA-pm96-6xpr-978x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no authentication middleware, no API key validation, and defaults to CORS allow_origins=["*"] with host="0.0.0.0", making every deployment network-accessible and queryable from any origin by default. This vulnerability is fixed in 4.5.128.
AnalysisAI
PraisonAI AgentOS prior to version 4.5.128 exposes agent metadata including names, roles, and system instruction snippets via an unauthenticated GET /api/agents endpoint accessible from any network origin due to missing authentication middleware and permissive CORS defaults. This information disclosure vulnerability allows remote attackers to enumerate agent configurations without credentials, potentially revealing sensitive operational details that could inform social engineering or reconnaissance attacks against multi-agent deployments.
Technical ContextAI
PraisonAI is a FastAPI-based multi-agent orchestration platform. The vulnerability stems from inadequate API security posture: the AgentOS application lacks authentication middleware for the /api/agents endpoint, performs no API key validation, and deploys with CORS allow_origins set to the wildcard ["*"] and host bound to 0.0.0.0 (all interfaces). This configuration, combined with no access control checks, allows any unauthenticated HTTP client to retrieve agent configuration metadata. The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) reflects a design flaw where sensitive operational metadata is exposed without identity verification or authorization checks. The first 100 characters of system instructions may leak prompt injection vectors, role descriptions, or internal operational context that should remain confidential.
RemediationAI
Vendor-released patch: PraisonAI 4.5.128. Upgrade immediately to version 4.5.128 or later to obtain the fix for the authentication and authorization defects in the AgentOS API. Immediate workarounds prior to patching include: restrict network access to the AgentOS deployment by implementing firewall rules to limit /api/agents endpoint access to trusted internal networks only, configure CORS to restrict allow_origins to known trusted domains instead of ["*"], and deploy API authentication middleware (API keys, OAuth2, or similar) in front of the AgentOS application to enforce access control. Refer to the GitHub security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pm96-6xpr-978x for detailed remediation guidance.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today