PraisonAI Vulnerability Exploited Within Hours of Public Disclosure

Cybersecuritynews •Abinaya • May 15, 2026

As artificial intelligence frameworks become central to enterprise operations, a critical flaw in a popular AI platform has exposed organizations to serious security risks from threat actors. Within hours of public disclosure, a severe vulnerability in PraisonAI’s legacy API server, tracked as CVE-2026-44338, is already sending shockwaves through the developer community. By shipping with authentication […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PraisonAI Vulnerability Exploited Hours After Disclosure A critical authentication bypass vulnerability in PraisonAI, tracked as CVE-2026-44338, was publicly disclosed on May 8, 2026, and has already been exploited by threat actors within hours of its announcement. The flaw affects versions 2.5.6 to 4.6.33 of PraisonAI's legacy Flask-based API server, which shipped with authentication disabled by default. Sysdig reported that scanning for vulnerable instances began less than four hours after the GitHub advisory was published. The vulnerability allows any reachable caller to interact with agent workflows without valid tokens, posing a significant risk to organizations that have not audited their security configurations. The flaw has a CVSS score of 7.3, indicating a high severity level, and organizations are urged to upgrade to version 4.6.34 immediately to mitigate risks. The rapid exploitation highlights the urgency for organizations to implement robust security measures around AI services. 4 sources 72

Extracted Entities

CVEs (1)

CVE-2026-44338

Platforms (1)

PraisonAI