PraisonAI 2.5.6 to < 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server.
id: CVE-2026-44338
info:
name: PraisonAI - Authentication Bypass
author: jnoza
severity: high
description: |
PraisonAI 2.5.6 to < 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server.
impact: |
Remote attackers can access and trigger agent workflows without authentication, potentially leading to unauthorized actions or data exposure.
remediation: Upgrade to version 4.6.34 or later.
reference:
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6rmh-7xcm-cpxj
- https://webflow.sysdig.com/blog/cve-2026-44338-praisonai-authentication-bypass-in-under-4-hours-and-the-growing-trend-of-rapid-exploitation
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
cvss-score: 7.3
cve-id: CVE-2026-44338
epss-score: 0.00823
epss-percentile: 0.55999
cwe-id: CWE-306
metadata:
verified: true
max-request: 1
shodan-query: html:"PraisonAI"
tags: cve,cve2026,praisonai,auth-bypass,vkev
http:
- method: GET
path:
- "{{BaseURL}}/agents"
matchers:
- type: dsl
dsl:
- "status_code == 200"
- "contains_all(body, 'agent_file', 'agents')"
- "contains(header, 'application/json')"
condition: and
# digest: 4b0a00483046022100a06c4c8a4a6e1a09cfec78d0bf8d6439c9016ab4cede1bc5aeec8ff9b1d302a602210082027e30e3feb1f3bf14646dfb6e8df7ad9666837830f022667ba6337a896f98:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.