PraisonAI Flaw Turns Exposed Agent APIs Into Targets
Internet-exposed PraisonAI instances are probeable almost as soon as disclosure lands, and the standard patch-first response misses the bigger issue: a legacy Flask API with auth disabled lets outsiders reach the agent control plane. If that interface is reachable, they can query /agents and drive the configured /chat workflow without a token, so this is not just an app bug but a reachable execution path through the agent layer.
Sysdig saw scanning begin within three hours and 44 minutes of public disclosure, with a scanner identifying itself as CVE-Detector/1.0 hitting the vulnerable endpoint on internet-exposed hosts. The flaw affects PraisonAI versions 2.5.6 through 4.6.33 and is tracked as CVE-2026-44338.
The immediate risk is exposure of workflow control, not simple metadata leakage. For teams that left the legacy API reachable, the attack surface is public as soon as the advisory appears, and probing can quickly separate exposed systems from the rest.