CVE-2026-57140: PraisonAI AgentOS Auth Bypass Vulnerability

CVE-2026-57140 Overview

CVE-2026-57140 is a missing authentication vulnerability in PraisonAI, a multi-agent teams system. The flaw exists in AgentOS within src/praisonai-ts/src/os/agentos.ts from version 1.6.0 through 1.7.1. The service binds to the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and exposes GET /api/agents and POST /api/chat without authentication middleware. Any remote caller who can reach the service can enumerate agent names, roles, and instruction prefixes. The attacker can then invoke a selected agent, potentially reaching its tools, memory, external APIs, credentials, and workflow state. An initial remediation was released in version 1.7.2. The weakness is classified under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated remote attackers can enumerate and invoke AI agents, gaining access to their tools, memory, connected APIs, and stored credentials.

Affected Products

PraisonAI versions 1.6.0 through 1.7.1
AgentOS component (src/praisonai-ts/src/os/agentos.ts)
Deployments using the default 0.0.0.0 bind configuration

Discovery Timeline

2026-09-15 - CVE-2026-57140 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-57140

Vulnerability Analysis

PraisonAI's AgentOS module registers two HTTP routes without applying any authentication middleware. The GET /api/agents endpoint returns metadata describing every registered agent, including names, roles, and instruction prefixes. The POST /api/chat endpoint accepts a target agent identifier and a user message, then dispatches the request to the selected agent runtime.

Because AgentOS defaults to binding on 0.0.0.0, the listener accepts connections on every network interface. Operators who launch PraisonAI on a workstation, container, or cloud host without an external firewall expose the endpoints to any reachable network. An attacker that can complete a TCP handshake to the service can trigger both routes.

Invoking /api/chat executes the selected agent with attacker-controlled input. This gives the caller indirect access to whatever the agent can reach, including linked tools, retrieval memory, external API integrations, stored credentials, and any in-progress workflow state.

Root Cause

The root cause is missing authentication for critical functions [CWE-306]. AgentOS does not attach an authentication or authorization middleware to the API routes, and the default host configuration in src/praisonai-ts/src/os/config.ts binds the server to all interfaces instead of loopback.

Attack Vector

Exploitation requires only network reachability to the AgentOS listener. No credentials, tokens, or user interaction are needed. An attacker sends a GET /api/agents request to enumerate available agents, then issues a crafted POST /api/chat request naming a chosen agent and supplying prompt content that drives the agent toward sensitive tools, memory, or external services.

// Vulnerability manifests in AgentOS route registration
// File: src/praisonai-ts/src/os/agentos.ts
// Routes GET /api/agents and POST /api/chat are registered
// without any authentication middleware, while the server
// binds to 0.0.0.0 by default (src/praisonai-ts/src/os/config.ts).
// See GitHub Security Advisory GHSA-9752-mhqh-h34f for details.

Detection Methods for CVE-2026-57140

Indicators of Compromise

Unexpected inbound connections to the AgentOS listener from non-local or untrusted source addresses.
HTTP access logs showing GET /api/agents or POST /api/chat requests without a preceding authenticated session.
Agent execution logs recording invocations that do not correspond to a known user, workflow, or scheduled task.
Outbound calls from agent tools or integrations to attacker-controlled destinations after unauthenticated API access.

Detection Strategies

Inspect network configuration for PraisonAI processes listening on 0.0.0.0 and any exposed AgentOS port on non-loopback interfaces.
Correlate reverse proxy or application logs to identify /api/agents enumeration followed by /api/chat invocation from the same source.
Flag any use of PraisonAI package versions between 1.6.0 and 1.7.1 in software inventories and container images.

Monitoring Recommendations

Enable and centralize AgentOS request logging, capturing source IP, path, and agent target for every /api/* request.
Alert on API traffic to AgentOS from outside expected client subnets, including public IP ranges.
Monitor outbound traffic from agent runtimes for connections to unfamiliar domains or credential endpoints.

How to Mitigate CVE-2026-57140

Immediate Actions Required

Upgrade PraisonAI to version 1.7.2 or later, which contains the initial remediation for CVE-2026-57140.
Restrict the AgentOS listener to 127.0.0.1 or a trusted internal interface until the upgrade is confirmed in production.
Place the service behind an authenticating reverse proxy that enforces identity on /api/agents and /api/chat.
Rotate any credentials, API keys, or tokens accessible to agents that were exposed while the service was reachable.

Patch Information

The PraisonAI maintainers released an initial fix in version 1.7.2. Related packaging updates were shipped in release v4.6.60, which pins praisonai>=4.6.60 in the project's Docker images. Review the GitHub Security Advisory GHSA-9752-mhqh-h34f, the GitHub Commit Update, and the GitHub Release v4.6.60 for full details.

Patched Docker configuration from the upstream commit:

text

 # Install Python packages (using latest versions)
 RUN pip install --no-cache-dir \
     praisonai_tools \
-    "praisonai>=4.6.59" \
+    "praisonai>=4.6.60" \
     "praisonai[chat]" \
     "embedchain[github,youtube]"

Source: GitHub Commit 709a038

Workarounds

Override the default host in src/praisonai-ts/src/os/config.ts to bind AgentOS to 127.0.0.1 and reach it only via SSH tunnel or an internal proxy.
Enforce network-layer controls such as host firewall rules, security groups, or Kubernetes NetworkPolicies that permit only trusted clients to reach the AgentOS port.
Terminate TLS and require authentication at an ingress layer such as NGINX, Envoy, or an API gateway before forwarding traffic to AgentOS.

bash

# Example: restrict AgentOS to loopback and firewall the port
export PRAISONAI_OS_HOST=127.0.0.1

# Block external access to the AgentOS port (adjust port as deployed)
sudo iptables -A INPUT -p tcp --dport 8000 ! -s 127.0.0.1 -j DROP