rapid-weaponizationinternet-exposed-serviceidentity-authentication-vulnerabilityinternet-facing-service-vulnerability

PraisonAI Authentication Bypass Scanned Within Hours of Disclosure

Attack Surface Exposure · 4 sources · Updated 4mo ago · First seen May 12, 2026

Threat actors began probing internet-exposed PraisonAI instances within 3 hours and 44 minutes of public disclosure of CVE-2026-44338, a missing-authentication flaw in the product’s legacy Flask API server. The vulnerability, tracked in GitHub advisory GHSA-6rmh-7xcm-cpxj, affects versions 2.5.6 through 4.6.33 and was fixed in 4.6.34. Sysdig said the issue stems from authentication being disabled by default in the legacy api_server.py, allowing unauthenticated access to protected endpoints including GET /agents and POST /chat.

Sysdig observed scanning from 146.190.133[.]49 using the User-Agent CVE-Detector/1.0, with activity focused on validating exploitability rather than full hands-on abuse, as no POST /chat requests were seen. Even so, exposed deployments could allow attackers to view agent configurations, trigger workflows defined in agents.yaml, exhaust model or API quotas, expose data, or execute downstream actions through connected tools. Defenders were urged to upgrade to PraisonAI 4.6.34 or later, retire the legacy API server, restrict exposure of port 8080, monitor for unauthenticated requests to /agents and /chat, and review credentials and billing tied to configured agents.

Is this exposed in your estate?Map this exposure pattern across your cloud, code, and identities.

Map your surface

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · May 11, 2026 – May 12, 2026

May 12, 20266mo ago
Sysdig publicly reports rapid post-disclosure probing activity
On 2026-05-12, Sysdig published research documenting the near-immediate scanning for CVE-2026-44338 and warning that exposed workflows could enable quota exhaustion, tool execution, data exposure, and downstream abuse. The company recommended upgrading to 4.6.34 or later, restricting exposure of port 8080, and monitoring for unauthenticated GET /agents and POST /chat requests.
May 11, 20266mo ago
Internet scanning for vulnerable PraisonAI instances begins within hours
Sysdig observed probing of internet-exposed PraisonAI instances 3 hours and 44 minutes after the public advisory, including requests from 146.190.133.49 using the User-Agent "CVE-Detector/1.0." The activity appeared aimed at validating exploitability of the vulnerable endpoint rather than fully weaponizing the flaw.
May 11, 20266mo ago
PraisonAI fixes CVE-2026-44338 in version 4.6.34
PraisonAI addressed the authentication bypass vulnerability in release 4.6.34. The fix remediated the legacy API server issue that had shipped with authentication disabled by default.
May 11, 20266mo ago
GitHub publishes advisory for PraisonAI auth bypass CVE-2026-44338
On 2026-05-11, GitHub published advisory GHSA-6rmh-7xcm-cpxj for CVE-2026-44338, a missing-authentication flaw in PraisonAI's legacy Flask API server. The issue affects versions 2.5.6 through 4.6.33 and can expose protected endpoints such as /agents and /chat to unauthenticated access.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Vulnerabilities

1 linked

Missing authentication in PraisonAI legacy Flask API server (CVE-2026-44338)

Affected products

1 linked

Praisonai

Organizations

1 linked

PraisonAI

Observables

1 linked

Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.

See Where You're Exposed

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · May 15, 2026

PraisonAI Vulnerability Exploited Within Hours of Public DisclosureOpen source ↗

The Hacker NewsNews · May 14, 2026

PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of DisclosureOpen source ↗

Sysdig BlogNews · May 12, 2026

CVE-2026-44338: PraisonAI authentication bypass in under 4 hours and the growing trend of rapid exploitation | SysdigOpen source ↗

Sysdig BlogNews · Apr 5, 2026

CVE-2026-44338: PraisonAI authentication bypass in under 4 hours and the growing trend of rapid exploitation | SysdigOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

rapid-weaponizationinternet-exposed-serviceidentity-authentication-vulnerabilityinternet-facing-service-vulnerability

PraisonAI Authentication Bypass Scanned Within Hours of Disclosure

Attack Surface Exposure · 4 sources · Updated 4mo ago · First seen May 12, 2026

Is this exposed in your estate?Map this exposure pattern across your cloud, code, and identities.

Map your surface

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · May 11, 2026 – May 12, 2026

May 12, 20266mo ago
Sysdig publicly reports rapid post-disclosure probing activity
On 2026-05-12, Sysdig published research documenting the near-immediate scanning for CVE-2026-44338 and warning that exposed workflows could enable quota exhaustion, tool execution, data exposure, and downstream abuse. The company recommended upgrading to 4.6.34 or later, restricting exposure of port 8080, and monitoring for unauthenticated GET /agents and POST /chat requests.
May 11, 20266mo ago
Internet scanning for vulnerable PraisonAI instances begins within hours
Sysdig observed probing of internet-exposed PraisonAI instances 3 hours and 44 minutes after the public advisory, including requests from 146.190.133.49 using the User-Agent "CVE-Detector/1.0." The activity appeared aimed at validating exploitability of the vulnerable endpoint rather than fully weaponizing the flaw.
May 11, 20266mo ago
PraisonAI fixes CVE-2026-44338 in version 4.6.34
PraisonAI addressed the authentication bypass vulnerability in release 4.6.34. The fix remediated the legacy API server issue that had shipped with authentication disabled by default.
May 11, 20266mo ago
GitHub publishes advisory for PraisonAI auth bypass CVE-2026-44338
On 2026-05-11, GitHub published advisory GHSA-6rmh-7xcm-cpxj for CVE-2026-44338, a missing-authentication flaw in PraisonAI's legacy Flask API server. The issue affects versions 2.5.6 through 4.6.33 and can expose protected endpoints such as /agents and /chat to unauthenticated access.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →