2026-05-15 · 2026-Q2
PraisonAI Auth-Disabled API Server (CVE-2026-44338)
Primary layerL6 Identity / Run
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- Yes
- Actor
- Attacker
Target
PraisonAI legacy Flask API server, before 4.6.34
Impact
Unauthenticated attackers enumerate configured agents via `GET /agents`, trigger workflows via `POST /chat`, extract sensitive output, and exhaust costly model quotas; exploited within hours of disclosure
Root cause
Hardcoded insecure defaults (`AUTH_ENABLED = False`, `AUTH_TOKEN = None`) with the server bound to `0.0.0.0:8080` and a `check_auth()` that fails open when auth is disabled
CVE
Sources
Catalog
Cite this: AgentProv incident record: PraisonAI Auth-Disabled API Server (CVE-2026-44338) (2026-05-15). https://agentprov.com/incidents/2026-05-15-praisonai-auth-disabled-api-server-cve-2026-44338
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run