CVE-2026-57140 in PraisonAI
Summary
by MITRE • 09/15/2026
PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authentication middleware. A remote caller who can reach the service can obtain agent names, roles, and instruction prefixes and can invoke a selected agent, potentially reaching its tools, memory, external APIs, credentials, and workflow state. An initial remediation was released in version 1.7.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within PraisonAI versions ranging from 1.6.0 to 1.7.2 represents a critical misconfiguration of the AgentOS component located at src/praisonai-ts/src/os/agentos.ts, which relies on default configuration settings defined in src/praisonai-ts/src/os/config.ts. Specifically, the service binds to the network interface address 0.0.0.0 by default, effectively exposing all registered endpoints to any network reachable host rather than restricting access to localhost or specific trusted internal networks. This binding behavior is compounded by the absence of authentication middleware on two primary API routes: GET /api/agents and POST /api/chat. The lack of an initial remediation in earlier versions allowed these unauthenticated endpoints to remain accessible, creating a significant attack surface for remote adversaries who can establish network connectivity to the affected service instance.
The technical flaw lies in the failure to enforce access control policies on sensitive operational interfaces. By exposing the GET /api/agents endpoint without authentication, an attacker can enumerate all available agents within the system, retrieving detailed metadata such as agent names, assigned roles, and instruction prefixes. This information disclosure provides a comprehensive map of the AI orchestration layer's capabilities and internal logic. Furthermore, the POST /api/chat endpoint allows for arbitrary invocation of these agents. Since PraisonAI is designed to facilitate multi-agent teams that interact with external tools, memory stores, APIs, and credentials, an unauthenticated user can effectively hijack these workflows. This capability enables the execution of commands or queries through the agent's toolset, potentially leading to unauthorized data access, manipulation of workflow states, or exfiltration of sensitive information stored within the agents' context windows or connected databases.
The operational impact of this vulnerability is severe due to the privileged nature of AI agent operations in modern software architectures. An attacker leveraging these endpoints can perform actions that are typically restricted to authenticated users with specific roles. This includes querying internal knowledge bases, executing code via integrated tools, and accessing external APIs using credentials embedded within the agent configurations. The exposure of instruction prefixes also aids in prompt injection attacks or reverse engineering efforts, allowing adversaries to understand how agents process inputs and make decisions. In environments where PraisonAI is used for automated business processes or sensitive data processing, this vulnerability could lead to significant confidentiality breaches, integrity violations through unauthorized state changes, and availability issues if malicious workflows are triggered that consume excessive resources or cause system instability.
This incident aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials, as the default configuration exposes sensitive functionality without requiring proof of identity. From a tactical perspective, it maps to MITRE ATT&CK techniques such as T1078 Valid Accounts if credentials are extracted via agent memory or tools, and T1505 Server Software Component which involves installing or using malicious software components like unauthorized API endpoints for persistence or execution. The exploitation path resembles common web application vulnerabilities where misconfigured servers expose administrative or internal APIs to the public internet, a pattern frequently observed in IoT devices and cloud-native applications that fail to implement defense-in-depth strategies.
Remediation efforts were introduced in version 1.7.2, which addresses these security gaps by implementing proper authentication mechanisms for the exposed endpoints and adjusting default binding configurations to restrict network accessibility. Organizations running affected versions must upgrade immediately to ensure that only authorized users can interact with agent orchestration features. Additionally, it is recommended to implement a reverse proxy or API gateway in front of PraisonAI instances to enforce additional layers of security such as rate limiting, IP whitelisting, and TLS encryption. Security teams should audit their network configurations to ensure that services binding to 0.0.0.0 are not inadvertently exposed to untrusted networks, adhering to the principle of least privilege by restricting access to only those subnets or hosts that require interaction with the AI agent system. Regular security assessments and penetration testing should be conducted to verify that authentication middleware is correctly applied to all sensitive API routes in future deployments.