EUVD-2026-43176
GHSA-g3pq-3vvx-36w6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remotely reachable default with no authentication (AV:N/AC:L/PR:N/UI:N); high confidentiality from prompt disclosure, low integrity/availability from unauthorized agent invocation and resource abuse.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.
AnalysisAI
Unauthenticated agent access in PraisonAI before 1.7.3 lets remote attackers read agent instructions and system prompts and directly invoke agents because the server ships with insecure defaults - binding to all network interfaces (0.0.0.0), enforcing no API key, and allowing wildcard CORS. Any attacker who can reach the service can call GET /api/agents to exfiltrate proprietary prompt logic or POST /api/chat to abuse the agents without credentials. There is no public exploit identified at time of analysis, but exploitation is trivial and requires no special tooling given the missing authentication.
Technical ContextAI
PraisonAI (CPE cpe:2.3:a:mervinpraison:praisonai) is an open-source multi-agent AI orchestration framework that exposes an HTTP API for interacting with configured LLM agents. The root cause maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the shipped default configuration binds the listener to all interfaces rather than localhost, omits any API-key/authentication middleware on the /api/agents and /api/chat routes, and returns a permissive wildcard CORS policy (Access-Control-Allow-Origin: *). The combination means the API surface - including endpoints that reveal system prompts and agent instructions - is reachable by any network client and by any web origin, turning a framework meant for trusted/local use into a network-exposed unauthenticated service.
RemediationAI
Vendor-released patch: 1.7.3 - upgrade PraisonAI to 1.7.3 or later, which corrects the insecure defaults; see the advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6wjp-v33h-5cvq. If you cannot upgrade immediately, apply compensating controls: bind the service to 127.0.0.1 (localhost) instead of 0.0.0.0 so it is not exposed on all interfaces (side effect - breaks remote clients that legitimately need network access, which must then be fronted by an authenticating proxy); place the API behind a reverse proxy or gateway that enforces authentication/API keys and network ACLs (side effect - added deployment complexity); restrict the CORS policy to explicit trusted origins rather than the wildcard (side effect - browser clients on other origins will be blocked); and firewall the listening port to trusted management networks only (side effect - blocks any intended remote consumers until allowlisted). Verify the /api/agents and /api/chat endpoints reject unauthenticated requests after remediation.
PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today