Loading story…
PraisonAI versions before 4.6.78 are affected by CVE-2026-61435, an authentication bypass in the Call API agent invocation functionality. The flaw appears when PRAISONAI_CALL_AUTH=disabled is configured: the application tries to restrict unauthenticated access to localhost, but determines the request origin from the client-controlled HTTP Host header via request.url.hostname, allowing an attacker to spoof 127.0.0.1 and appear local.
A remote unauthenticated attacker who can reach the service can exploit the issue to access agent-related endpoints without logging in, including GET /api/v1/agents to enumerate registered agents and POST /api/v1/agents/{agent_id}/invoke to invoke them. The vulnerable logic is reported in src/praisonai/praisonai/api/agent_invoke.py; the issue is classified as CWE-287 and carries a CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, indicating low-complexity network exploitation with high integrity impact.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A vulnerability affecting PraisonAI before version 4.6.78 was disclosed in which a remote unauthenticated attacker can spoof the HTTP Host header as 127.0.0.1 to bypass localhost-only restrictions when PRAISONAI_CALL_AUTH is disabled. The flaw allows unauthorized listing of registered agents and invocation of agent-related API endpoints.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
vulncheck.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors began probing internet-exposed **PraisonAI** instances within **3 hours and 44 minutes** of public disclosure of `CVE-2026-44338`, a missing-authentication flaw in the product’s legacy Flask API server. The vulnerability, tracked in GitHub advisory `GHSA-6rmh-7xcm-cpxj`, affects versions **2.5.6 through 4.6.33** and was fixed in **4.6.34**. Sysdig said the issue stems from authentication being disabled by default in the legacy `api_server.py`, allowing unauthenticated access to protected endpoints including `GET /agents` and `POST /chat`. Sysdig observed scanning from **146.190.133[.]49** using the User-Agent **`CVE-Detector/1.0`**, with activity focused on validating exploitability rather than full hands-on abuse, as no `POST /chat` requests were seen. Even so, exposed deployments could allow attackers to view agent configurations, trigger workflows defined in `agents.yaml`, exhaust model or API quotas, expose data, or execute downstream actions through connected tools. Defenders were urged to upgrade to **PraisonAI 4.6.34 or later**, retire the legacy API server, restrict exposure of **port 8080**, monitor for unauthenticated requests to `/agents` and `/chat`, and review credentials and billing tied to configured agents.
Jun 29, 2026
A critical remote code execution flaw, **`CVE-2026-61447`**, was disclosed in the PraisonAI AI agent framework, affecting versions before **`1.6.78`**. The vulnerability lies in **`CodeAgent._execute_python()`**, which executes LLM-generated Python without AST validation, import restrictions, or sandbox enforcement, allowing attackers to use prompt injection to make the agent run arbitrary code on the host. The issue received the maximum severity rating of **CVSS 10.0** under both v3.1 and v4.0. Successful exploitation can result in full host compromise and theft of sensitive data, including API keys, cloud credentials, database passwords, and other environment secrets, with potential pivoting into connected services. PraisonAI **`1.6.78`** fixes the issue, and defenders are being urged to upgrade immediately, reduce network exposure, rotate potentially exposed secrets, and monitor for anomalous outbound connections; no confirmed in-the-wild exploitation had been reported at disclosure time.
Jul 11, 2026
PraisonAI, a multi-agent teams platform, disclosed two high-severity vulnerabilities affecting versions before **4.5.97** and **4.5.90**. The more severe issue, tracked as `CVE-2026-34953`, stems from `OAuthManager.validate_token()` returning `True` for tokens missing from its internal store, which is empty by default. That logic flaw lets attackers present arbitrary Bearer tokens to authenticate to the MCP server and gain full access to registered tools and agent capabilities. The vulnerability was classified as **CWE-863** with a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. A second flaw, `CVE-2026-34934`, exposed PraisonAI to second-order SQL injection through `get_all_user_threads`. In affected versions before **4.5.90**, the function constructed raw SQL queries with Python f-strings using unescaped thread IDs previously stored in the database, allowing an attacker to plant a malicious thread ID via `update_thread` and trigger injection when thread lists were loaded. The bug could lead to full database compromise and was classified as **CWE-89** with a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`; both issues were addressed in patched releases published through GitHub Security Advisories.
Jun 29, 2026