{"id":"CVE-2026-57116","published":"2026-10-23T13:17:10.690","lastModified":"2026-10-23T13:17:10.827","description":"PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-200","CWE-306","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-892r-p3jq-jp24","tags":[]}],"exploitRefs":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-892r-p3jq-jp24","tags":[]}],"hasPoc":true,"ai":{"summary":"PraisonAI's AgentOS FastAPI deployment exposes an unauthenticated chat endpoint that directly executes agent logic without verifying credentials, allowing any remote attacker to trigger agents with access to private tools, context, memory, and cost-bearing API calls.","exploitability":"Trivial to exploit over the network with no authentication or user interaction required; any HTTP client can send a POST request to the chat route.","blast_radius":"Attackers can abuse deployed agents to exfiltrate sensitive data, perform unauthorized actions via integrated tools, or incur financial costs through model API calls.","remediation":"Upgrade to PraisonAI version 4.6.59 or later, which patches the missing authentication on the AgentOS FastAPI chat endpoint.","detection":"Look for POST requests to the /chat endpoint without a valid Authorization header, especially from external or unexpected IP addresses; repeated or high-volume requests to this endpoint may indicate exploitation attempts.","tags":["auth-bypass","unauthenticated-access","agent-orchestration","api-abuse"],"model":"garnet-coder","analyzedAt":"2026-10-24T09:01:37.087Z"}}