CVE-2026-57116: PraisonAI: unauthenticated AgentOS chat API drives agents

CRITICAL

Published October 23, 2026

CISO Take

PraisonAI's AgentOS FastAPI deployment exposes its chat route with no authentication, so any network client can send a message that runs the deployed agent. This is a bypass of the earlier fix for CVE-2026-40151. Anyone who can reach the endpoint can drive agents that hold tools, private context, memory, API integrations or paid model calls, which makes it a data-exposure, action-execution and cost-abuse risk at once. The CVSS score is 9.8 with network access, low complexity and no privileges required. EPSS, KEV and SSVC data are not yet available, and there is no known public exploit or Nuclei template, but exploitation is trivial. Upgrade praisonai to 4.6.59 or later. Until you can, put AgentOS behind an authenticating reverse proxy or network allowlist, and review access logs for unexpected chat requests.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Critical. The flaw is remotely exploitable with no credentials and no user interaction, and wrong bearer tokens are also accepted. It is a regression of an earlier patch, so teams that applied the CVE-2026-40151 fix may wrongly believe they are protected. Real impact depends on the agent's capabilities: agents with tools, data access or integrations turn this into data theft or unauthorized actions, while agents with only model access still allow cost abuse. Exposure is limited to deployments that run AgentOS and are reachable by an attacker. No exploitation in the wild is reported and there is no public exploit, but the barrier to exploitation is very low. EPSS and SSVC data are unavailable.

How does the attack unfold?

Discovery

The attacker finds a network-reachable PraisonAI AgentOS endpoint through scanning or exposed service listings.

AML.T0006

Initial Access

The attacker sends a chat request with no credentials or a wrong bearer token, and the server accepts it.

AML.T0049

Agent Abuse

The attacker's messages are passed to agent.chat(), which invokes tools and reads private context or memory.

AML.T0053

Impact

Sensitive data is exposed, unauthorized actions are performed through connected APIs, and model costs are driven up.

AML.T0085.001

Discovery

The attacker finds a network-reachable PraisonAI AgentOS endpoint through scanning or exposed service listings.

AML.T0006

Initial Access

The attacker sends a chat request with no credentials or a wrong bearer token, and the server accepts it.

AML.T0049

Agent Abuse

The attacker's messages are passed to agent.chat(), which invokes tools and reads private context or memory.

AML.T0053

Impact

Sensitive data is exposed, unauthorized actions are performed through connected APIs, and model costs are driven up.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade praisonai to 4.6.59 or later and confirm the installed version in every environment, including containers and notebooks. 2) Do not rely on the earlier CVE-2026-40151 patch. 3) Until patched, do not expose AgentOS to untrusted networks; place it behind an authenticating reverse proxy, API gateway, VPN or IP allowlist. 4) Apply least privilege to agent tools and credentials, and rotate any secrets or API keys the agents can reach if exposure is suspected. 5) Detect abuse by reviewing HTTP logs for chat route requests from unknown sources or without valid credentials, and by watching for spikes in LLM spend or unexpected tool calls. 6) Set rate limits and budget caps on model provider accounts.

How is it classified?

Auth BypassData LeakageData ExtractionAgentAPIFrameworkAML.T0034.002- Agentic Resource Consumption AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0084.001- Tool Definitions AML.T0085.001- AI Agent Tools AML.T0096- AI Service API

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and ensure mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive AgencyLLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-57116?

Is CVE-2026-57116 actively exploited?

No confirmed active exploitation of CVE-2026-57116 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57116?

1) Upgrade praisonai to 4.6.59 or later and confirm the installed version in every environment, including containers and notebooks. 2) Do not rely on the earlier CVE-2026-40151 patch. 3) Until patched, do not expose AgentOS to untrusted networks; place it behind an authenticating reverse proxy, API gateway, VPN or IP allowlist. 4) Apply least privilege to agent tools and credentials, and rotate any secrets or API keys the agents can reach if exposure is suspected. 5) Detect abuse by reviewing HTTP logs for chat route requests from unknown sources or without valid credentials, and by watching for spikes in LLM spend or unexpected tool calls. 6) Set rate limits and budget caps on model provider accounts.

What systems are affected by CVE-2026-57116?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, agent API gateways, tool-using LLM agents, RAG pipelines.

What is the CVSS score for CVE-2026-57116?

CVE-2026-57116 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.42%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemsagent API gatewaystool-using LLM agentsRAG pipelines

MITRE ATLAS Techniques

AML.T0034.002Agentic Resource Consumption

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0084.001Tool Definitions

AML.T0085.001AI Agent Tools

AML.T0096AI Service API

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06, LLM10

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.

Exploitation Scenario

An attacker scans for internet-facing PraisonAI AgentOS instances and sends a plain HTTP request to the chat route with no token, or with an arbitrary bearer token. The server passes the message straight to agent.chat(). The attacker asks the agent to list its tools and knowledge sources, then instructs it to retrieve internal documents, query connected APIs or send data to an external destination. They can also loop requests to burn the victim's LLM API budget.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-306Missing Authentication for Critical FunctionPrimary CWE-862Missing AuthorizationPrimary CWE-200Exposure of Sensitive Information to an Unauthorized Actor CWE-306Missing Authentication for Critical Function CWE-862Missing Authorization

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.