CVE-2026-44338
CVSS 7.3 HIGH: praisonAI is a multi-agent teams system. EPSS 29% (98th percentile).
Vulnerabilities & Exploits · Web App Attack
Internet-exposed PraisonAI instances are probeable almost as soon as disclosure lands, and the standard patch-first response misses the bigger issue: a legacy Flask API with auth disabled lets outsiders reach the agent control plane. If that interface is reachable, they can query /agents and drive the configured /chat workflow without a token, so this is not just an app bug but a reachable execution path through the agent layer.
Sysdig saw scanning begin within three hours and 44 minutes of public disclosure, with a scanner identifying itself as CVE-Detector/1.0 hitting the vulnerable endpoint on internet-exposed hosts. The flaw affects PraisonAI versions 2.5.6 through 4.6.33 and is tracked as CVE-2026-44338.
The immediate risk is exposure of workflow control, not simple metadata leakage. For teams that left the legacy API reachable, the attack surface is public as soon as the advisory appears, and probing can quickly separate exposed systems from the rest.
2 sources · May 14
CVSS 7.3 HIGH: praisonAI is a multi-agent teams system. EPSS 29% (98th percentile).
The Hacker News
PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of Disclosure
PraisonAI auth bypass exposed /agents after May 11 disclosure, enabling exploit checks within 3h44m.
originalSecurityWeek
Hackers Targeted PraisonAI Vulnerability Hours After Disclosure
The first exploitation attempts were observed less than four hours after the authentication bypass was publicly disclosed.
originalPart of the PlainSec briefing for 2026-05-16
Every edition of this story: PraisonAI Flaw Turns Exposed Agent APIs Into Targets