AI Threat AlertCVE-2026-57118: PraisonAI agents: unauthenticated access to agent endpoints
CRITICALPoC AVAILABLECISA: ATTENDPraisonAI's AgentTeam.launch (and the Agents alias) exposes its list and chat HTTP endpoints with no authentication or authorization checks, so anyone who can reach the server can enumerate agents and send them prompts. Because the agents often hold model API keys, private context and tool access, an anonymous caller can burn model spend, read connected data and trigger tool side effects such as file, web or workflow actions. The CVSS is 9.8 with network access, low complexity and no privileges needed. EPSS data is not yet available, it is not in CISA KEV, and no public exploit or Nuclei template is known, but the flaw is trivial to exploit once an exposed server is found. Upgrade praisonaiagents to 1.6.59 or later, and until then keep any launched agent server off public networks or behind an authenticating reverse proxy.
What is the risk?
Critical when the server is reachable beyond localhost. Exploitation needs only HTTP requests, with no credentials, user interaction or special AI knowledge. Impact depends on what the agents can do: LLM spend, disclosure of private context or RAG data, and execution of agent tools with real side effects. The CVSS rates confidentiality, integrity and availability all High. Exploitation in the wild is unconfirmed: EPSS is unavailable, there is no KEV listing and no public exploit. Exposure is likely limited to teams that deploy AgentTeam.launch as a network service, and the dependent count is unknown.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | — | No patch |
| PraisonAI Agents | pip | — | No patch |
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade praisonaiagents to 1.6.59 or later (fix commit b4270173d4123fb1ee8910588f0896668ee21b59, advisory GHSA-x8cv-xmq7-p8xp). 2) Until patched, bind launched servers to 127.0.0.1 or an internal network and block public ingress with firewall or security group rules. 3) Place an authenticating reverse proxy or API gateway (mTLS, OIDC or API key) in front of any agent endpoint. 4) Inventory agent tools and rotate any API keys, tokens and secrets the agents can reach if exposure is suspected. 5) Detect by reviewing access logs for unauthenticated GET /*/list and POST requests from unknown IPs, unexplained spikes in model token usage or billing, and unexpected tool invocations or workflow runs. 6) Scan internal and external ranges for exposed PraisonAI agent servers.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-57118?
PraisonAI's AgentTeam.launch (and the Agents alias) exposes its list and chat HTTP endpoints with no authentication or authorization checks, so anyone who can reach the server can enumerate agents and send them prompts. Because the agents often hold model API keys, private context and tool access, an anonymous caller can burn model spend, read connected data and trigger tool side effects such as file, web or workflow actions. The CVSS is 9.8 with network access, low complexity and no privileges needed. EPSS data is not yet available, it is not in CISA KEV, and no public exploit or Nuclei template is known, but the flaw is trivial to exploit once an exposed server is found. Upgrade praisonaiagents to 1.6.59 or later, and until then keep any launched agent server off public networks or behind an authenticating reverse proxy.
Is CVE-2026-57118 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-57118, increasing the risk of exploitation.
How to fix CVE-2026-57118?
1) Upgrade praisonaiagents to 1.6.59 or later (fix commit b4270173d4123fb1ee8910588f0896668ee21b59, advisory GHSA-x8cv-xmq7-p8xp). 2) Until patched, bind launched servers to 127.0.0.1 or an internal network and block public ingress with firewall or security group rules. 3) Place an authenticating reverse proxy or API gateway (mTLS, OIDC or API key) in front of any agent endpoint. 4) Inventory agent tools and rotate any API keys, tokens and secrets the agents can reach if exposure is suspected. 5) Detect by reviewing access logs for unauthenticated GET /*/list and POST requests from unknown IPs, unexplained spikes in model token usage or billing, and unexpected tool invocations or workflow runs. 6) Scan internal and external ranges for exposed PraisonAI agent servers.
What systems are affected by CVE-2026-57118?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, agent tool orchestration, RAG pipelines, workflow automation.
What is the CVSS score for CVE-2026-57118?
CVE-2026-57118 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.41%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0034.002Agentic Resource ConsumptionAML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationAML.T0084Discover AI Agent ConfigurationAML.T0085Data from AI ServicesAML.T0096AI Service APICompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.
Exploitation Scenario
An attacker finds an internet-exposed PraisonAI agent server through scanning or search engines. They send GET /agents/list to enumerate agent names and IDs. They then POST prompts to /agents/{agent_id} asking the agent to summarize its connected private documents, reveal its configuration, or run its tools, for example reading files, calling internal APIs or sending messages. They can also loop requests to exhaust the victim's LLM budget. Since no authentication is required, the whole attack is a few HTTP calls.
Weaknesses (CWE)
CWE-306Missing Authentication for Critical FunctionPrimaryCWE-862Missing AuthorizationPrimaryCWE-306Missing Authentication for Critical FunctionCWE-862Missing AuthorizationCWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- [Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-3493810.0praisonaiagents: sandbox bypass enables full host RCE
Same package: praisonaiagentsCVE-2026-3988810.0praisonaiagents: sandbox escape enables host RCE
Same package: praisonaiagentsCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiagentsCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonaiagentsGHSA-vc46-vw85-3wvm9.8PraisonAI: RCE via malicious workflow YAML execution
Same package: praisonaiagents