PraisonAI EUVD-2026-65500

No special conditions beyond network reachability to the PraisonAI serve agents HTTP port. The flaw is triggered precisely by the standard production deployment pattern: operator runs 'praisonai serve agents --api-key <secret>' and binds to 0.0.0.0 expecting the key to gate access. Any caller that can reach POST /agents or POST /agents/{agent_name} - no Authorization header, no X-API-Key, no query token - can invoke agents. The /api/v1/agents/{agent_id}/invoke route on the same server is separately protected by CALL_SERVER_TOKEN and is NOT affected. Exploitation is limited by: (1) network exposure - servers bound only to localhost are not reachable externally; (2) agent capability - impact scales with what tools are granted to configured agents; (3) version - only 4.6.34 through 4.6.57 are affected. No user interaction, authentication, or non-default configuration is required to exploit the affected endpoints.

The CVSS 8.6 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) accurately reflects that this is a zero-complexity, unauthenticated, network-exploitable flaw. The C:L/I:L/A:H breakdown is conservative by design - the base vector cannot account for agent-specific capabilities, and operators who deploy agents with file system access, outbound HTTP tools, or external API integrations may face confidentiality and integrity impact well beyond what L ratings suggest; the actual blast radius scales entirely with the configured agent's tool permissions. EPSS data was not provided in the available input. KEV listing is not confirmed. A PoC is confirmed present in the GHSA advisory, which meaningfully elevates exploitability beyond what an unconfirmed theoretical flaw would warrant. The primary real-world limiting factor is network exposure: deployments bound to localhost or behind internal-only firewalls face substantially lower risk than those exposed to the internet or broad corporate networks - yet the vulnerability is specifically triggered by the configuration operators use for external production deployments (bind to 0.0.0.0 with --api-key). There is no conflict between the CVSS network vector and the description; the flaw is inherently network-side. Overall this is a genuine priority for any operator running an internet-facing PraisonAI serve agents instance in the affected version range.

A PoC is confirmed in GHSA-7ww9-85pg-cv4x. An unauthenticated attacker with network access to a PraisonAI serve agents instance sends a POST request to /agents or /agents/{agent_name} without any Authorization header; the server processes the request and executes the configured agent as if fully authorized. If the agent is equipped with web access, shell, or file-system tools, the attacker can achieve the corresponding capability without ever obtaining the operator-configured API key.