PraisonAI 2.5.6 to < 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server.
id: CVE-2026-44338
info:
name: PraisonAI - Authentication Bypass
author: jnoza
severity: high
description: |
PraisonAI 2.5.6 to < 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server.
impact: |
Remote attackers can access and trigger agent workflows without authentication, potentially leading to unauthorized actions or data exposure.
remediation: Upgrade to version 4.6.34 or later.
reference:
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6rmh-7xcm-cpxj
- https://webflow.sysdig.com/blog/cve-2026-44338-praisonai-authentication-bypass-in-under-4-hours-and-the-growing-trend-of-rapid-exploitation
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
cvss-score: 7.3
cve-id: CVE-2026-44338
epss-score: 0.28571
epss-percentile: 0.98034
cwe-id: CWE-306
metadata:
verified: true
max-request: 1
shodan-query: html:"PraisonAI"
tags: cve,cve2026,praisonai,auth-bypass,vkev
http:
- method: GET
path:
- "{{BaseURL}}/agents"
matchers:
- type: dsl
dsl:
- "status_code == 200"
- "contains_all(body, 'agent_file', 'agents')"
- "contains(header, 'application/json')"
condition: and
# digest: 4a0a0047304502206c8d2b69a9babbc5b5473c864bfb23b65760c78450decf4d07f5705e12196176022100c6d150e33c8ce99daee5c0cb1cdf2a5d9126f1f42aff4e78b0da3ecfa8c0ef2f:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.