CVE-2026-57118: PraisonAI Authentication Bypass Vulnerability

CVE-2026-57118 Overview

CVE-2026-57118 is a missing authentication vulnerability [CWE-306] in PraisonAI, a multi-agent teams system maintained by MervinPraison. Versions of praisonaiagents prior to 1.6.59 expose the AgentTeam.launch and Agents alias endpoints without any access-control checks. The exposed routes include GET /{path}/list, POST /{path}, and POST /{path}/{agent_id}. Any remotely reachable PraisonAI server allows unauthenticated clients to enumerate agents, invoke agent.chat, consume model resources, read connected private context, and trigger agent tools or workflow side effects. The maintainers fixed the issue in praisonaiagents 1.6.59 by introducing API key authentication middleware for AgentOS.

Critical Impact
Unauthenticated network attackers can invoke arbitrary agent actions, drain model quotas, exfiltrate connected context, and trigger tool-based side effects on exposed PraisonAI servers.

Affected Products

PraisonAI praisonaiagents package versions prior to 1.6.59
PraisonAI AgentOS AgentTeam.launch endpoints
PraisonAI Agents alias endpoints exposing /list, POST /{path}, and POST /{path}/{agent_id}

Discovery Timeline

2026-10-12 - CVE-2026-57118 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-57118

Vulnerability Analysis

PraisonAI exposes HTTP routes that mediate access to multi-agent orchestration primitives. In vulnerable versions, the AgentTeam.launch method and the Agents alias register three routes with FastAPI-style path parameters: GET /{path}/list to enumerate registered agents, POST /{path} to interact with the default agent, and POST /{path}/{agent_id} to invoke a specific agent by identifier. None of these routes perform authentication, authorization, or rate limiting before delegating to agent.chat.

An attacker who can reach the server over the network can therefore list every registered agent, send arbitrary prompts, and trigger any tools wired into those agents. If the agents are connected to private data sources, cloud APIs, or outbound actions, those capabilities become directly reachable from the public internet. The issue is tracked as GHSA-x8cv-xmq7-p8xp.

Root Cause

The root cause is a missing authentication control [CWE-306]. The route registration logic inside AgentTeam.launch and the Agents alias did not install any authentication dependency before invoking agent methods. The patch in commit b4270173 introduces an API key authentication middleware for AgentOS that gates these endpoints.

Attack Vector

The vulnerability is exploitable remotely over the network with no privileges and no user interaction. A typical attack flow is:

Discover a reachable PraisonAI AgentOS server.
Issue GET /{path}/list to enumerate agent identifiers and tool metadata.
Send POST /{path}/{agent_id} with a chosen prompt to invoke agent.chat and any attached tools.
Chain prompts to exfiltrate connected context, trigger workflow side effects, or exhaust model quotas.

The accompanying patch also normalizes agent configuration from llm= to model= across the benchmarks that exercise these endpoints:

python

    return PraisonAgent(
        name="Test Agent",
        instructions="Be concise, reply with one sentence.",
-       llm="gpt-4o-mini",
+       model="gpt-4o-mini",
        tools=tools,
        output="silent"
    )

Source: MervinPraison/PraisonAI commit b4270173

Detection Methods for CVE-2026-57118

Indicators of Compromise

Unauthenticated GET requests to any /{path}/list route on a PraisonAI AgentOS server.
POST requests to /{path} or /{path}/{agent_id} without an Authorization or API key header.
Unexpected spikes in model API usage, token consumption, or outbound tool invocations originating from the agent host.
Access logs showing agent enumeration followed by rapid, repeated agent.chat invocations from a single source.

Detection Strategies

Inventory running praisonaiagents services and confirm the installed version using pip show praisonaiagents.
Inspect reverse-proxy or application logs for routes matching the AgentTeam.launch and Agents alias patterns served without authentication.
Hunt in SIEM telemetry for HTTP 200 responses to /list endpoints from external source IPs.
Correlate LLM provider billing or rate-limit events with inbound traffic to PraisonAI hosts.

Monitoring Recommendations

Forward PraisonAI application and proxy logs into a centralized analytics platform for continuous review.
Alert on any inbound request to AgentOS endpoints that lacks the API key header introduced in 1.6.59.
Baseline normal agent.chat request volume per agent and alert on deviations.
Monitor egress from agent hosts to detect tool-triggered data exfiltration or unexpected third-party API calls.

How to Mitigate CVE-2026-57118

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.59 or later as published in the v4.6.59 release.
Remove public network exposure of AgentOS endpoints until the upgrade is confirmed.
Rotate any API keys, model provider tokens, or tool credentials that were reachable from the exposed agents.
Review access and model usage logs for the full window the service was exposed.

Patch Information

The fix is delivered in praisonaiagents 1.6.59 via commit b4270173d4123fb1ee8910588f0896668ee21b59, which implements API key authentication middleware for AgentOS. Full advisory details are available at GHSA-x8cv-xmq7-p8xp.

Workarounds

Place AgentOS behind a reverse proxy that enforces authentication, such as mutual TLS or an API gateway with API keys.
Bind the AgentOS listener to 127.0.0.1 or a private network interface and restrict access with host or network firewall rules.
Disable the AgentTeam.launch and Agents alias routes in deployments that do not require remote invocation.
Apply strict egress controls and least-privilege tool configurations so that any invoked agent has limited blast radius.

bash

# Upgrade to the patched release
pip install --upgrade "praisonaiagents>=1.6.59"

# Verify the installed version
pip show praisonaiagents | grep -i version

# Restrict exposure at the host firewall until validated
sudo ufw default deny incoming
sudo ufw allow from 10.0.0.0/8 to any port 8000 proto tcp
sudo ufw enable