PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 4.6.59
- Public exploit
- None on Exploit-DB
Summary
PraisonAI, a multi-agent framework, has an AgentOS FastAPI deployment that lacks authentication, so anyone who can reach it over the network can invoke the deployed agents without credentials. This allows remote parties to run agents that may use tools, private data, memory, API integrations, or paid model calls.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
Affected versions
- MervinPraison PraisonAI
From 4.2.1 · fixed in 4.6.59