PraisonAI Fixes Critical Auth Bypass in Agent Teams Before 1.6.59

MervinPraison has released a security update for PraisonAI to address a critical authentication bypass flaw that allows unauthenticated remote access to agent systems. The vulnerability, tracked as CVE-2026-57118, affects versions of the praisonaiagents package prior to 1.6.59 and the main PraisonAI product before version 4.6.59.

The National Vulnerability Database rates the flaw as critical with a CVSS score of 9.8. The issue stems from missing access-control checks on several HTTP endpoints within the AgentTeam.launch module and the Agents alias. Specifically, the GET /{path}/list endpoint, along with two POST endpoints at /{path} and /{path}/{agent_id}, fail to verify user credentials before processing requests.

Context and Background

According to the NVD record, the affected endpoints allow clients to list available agents and invoke the agent.chat function without any form of authentication. This means that if a PraisonAI server is exposed to the internet, any remote user can interact with it freely. The weaknesses are categorized under CWE-306, which relates to incorrect default permissions, and CWE-862, concerning missing authorization for critical function.

An attacker exploiting this configuration can enumerate all agents running on the system. Beyond simple discovery, the flaw permits the consumption of model resources, which could lead to significant financial costs or denial of service for legitimate users. Furthermore, unauthenticated clients can access connected private context data, potentially exposing sensitive information stored within the agent’s memory or connected databases.

The vulnerability also allows remote users to trigger agent tools and workflow side effects. This capability extends the risk beyond data leakage to include arbitrary actions performed by the agents, depending on what tools and workflows are configured within the system. The lack of access control means these actions occur without any verification of the requester’s identity or permissions.

Who is Affected

The vulnerability impacts users of the PraisonAI multi-agent teams system developed by MervinPraison. Specifically, installations using the praisonaiagents package version 1.6.58 or earlier are vulnerable. Additionally, users of the main PraisonAI product running version 4.6.58 or earlier are also affected by this security gap.

Organizations that have deployed PraisonAI servers accessible from the public internet are at the highest risk. Internal deployments may also be vulnerable if network segmentation does not restrict access to these specific API endpoints. The fix is available in praisonaiagents version 1.6.59 and PraisonAI version 4.6.59.

What should you do?

Administrators should immediately verify their current versions of PraisonAI and praisonaiagents. If running a version prior to the fixed releases, they should update to version 1.6.59 or 4.6.59 as soon as possible. Until an update can be applied, restricting network access to the affected API endpoints can mitigate the risk of remote exploitation.