Loading vulnerability…
Missing authentication in PraisonAI legacy Flask API server
CVE-2026-44338 is a missing-authentication vulnerability in the legacy Flask API server of PraisonAI, a multi-agent orchestration framework. Versions 2.5.6 through 4.6.33 ship with authentication disabled and no authentication token configured. The check_auth() helper returns success when authentication is disabled, allowing network-reachable callers to enumerate configured agent metadata and execute the operator's predefined agent workflow without credentials. The workflow handler ignores the submitted message value and runs the configured workflow. Exploitation can disclose workflow results, consume billed model-provider resources, and invoke configured agent tools. The legacy-server vulnerability was fixed in version 4.6.34.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthenticated attackers can retrieve configured agent metadata and workflow output and repeatedly invoke automated workflows using the operator's model-provider credentials. This can exhaust API quotas or incur charges. Additional effects depend on the configured workflow and its permissions: exposed tools may execute code, perform file or HTTP operations, disclose data, send messages, or initiate downstream workflows. Unrestricted arbitrary code execution is not established independently of those configured capabilities. Observed scanning successfully retrieved agent metadata, but no workflow-triggering POST requests were observed during the documented scanning passes.
If you can’t patch tonight, do this now.
Restrict API-server access to trusted networks and avoid public exposure or unnecessary all-interface bindings. For generated servers, explicitly configure APIConfig(auth_enabled=True, auth_token=...) and enforce authentication. The serve agents deployment path binds to loopback by default and requires an API key. Monitor unauthenticated agent-enumeration and workflow-execution requests, review model-provider billing, and review credentials and tool permissions available to configured workflows.
Patch, then assume compromise.
Upgrade the affected legacy-server deployment to PraisonAI 4.6.34 or later and migrate away from the legacy API server to the secure-by-default serve agents command. A separate advisory concerning API servers generated by deploy --type api identifies 4.6.40 or later as the fixed version; use that release or later when generated deployments are involved. Regenerate or modify existing generated servers to ensure authentication is enabled and enforced rather than relying solely on a package upgrade.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.