Vulnerabilities · 123 days ago

PraisonAI Flaw Turns Exposed Agent APIs Into Targets

Internet-exposed PraisonAI instances are probeable almost as soon as disclosure lands, and the standard patch-first response misses the bigger issue: a legacy Flask API with auth disabled lets outsiders reach the agent control plane. If that interface is reachable, they can query /agents and drive the configured /chat workflow without a token, so this is not just an app bug but a reachable execution path through the agent layer.

Sysdig saw scanning begin within three hours and 44 minutes of public disclosure, with a scanner identifying itself as CVE-Detector/1.0 hitting the vulnerable endpoint on internet-exposed hosts. The flaw affects PraisonAI versions 2.5.6 through 4.6.33 and is tracked as CVE-2026-44338.

The immediate risk is exposure of workflow control, not simple metadata leakage. For teams that left the legacy API reachable, the attack surface is public as soon as the advisory appears, and probing can quickly separate exposed systems from the rest.

CVE-2026-44338

NVD KEV

CVSS 7.3 HIGH: praisonAI is a multi-agent teams system. EPSS 29% (98th percentile).

Timeline

May 14 Reported by The Hacker News

Sources

2 sources covering this story

The Hacker News May 14
PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of Disclosure
PraisonAI auth bypass exposed /agents after May 11 disclosure, enabling exploit checks within 3h44m.
SecurityWeek May 14
Hackers Targeted PraisonAI Vulnerability Hours After Disclosure
The first exploitation attempts were observed less than four hours after the authentication bypass was publicly disclosed.

Entities

CVE-2026-44338

Part of the PlainSec briefing for 2026-05-16

Editions

Vulnerabilities · 123 days agoPraisonAI Flaw Turns Exposed Agent APIs Into TargetsInternet-exposed PraisonAI instances are probeable almost as soon as disclosure lands, and the standard patch-first response misses the bigger issue: a legacy Flask API with auth disabled lets outsiders reach the agent control plane. If that interface is reachable, they can query /agents and drive the configured /chat workflow without a token, so this is not just an app bug but a reachable execution path through the agent layer.Sysdig saw scanning begin within three hours and 44 minutes of public disclosure, with a scanner identifying itself as CVE-Detector/1.0 hitting the vulnerable endpoint on internet-exposed hosts. The flaw affects PraisonAI versions 2.5.6 through 4.6.33 and is tracked as CVE-2026-44338.The immediate risk is exposure of workflow control, not simple metadata leakage. For teams that left the legacy API reachable, the attack surface is public as soon as the advisory appears, and probing can quickly separate exposed systems from the rest.