PraisonAI's Open-Source Agent Framework Shipped With Auth Disabled

On May 11, 2026 a GitHub advisory disclosed CVE-2026-44338 (CVSS 7.3) in PraisonAI's legacy Flask API where AUTH_ENABLED was hard-coded false in versions 2.5.6–4.6.33, enabling an authentication bypass; a public scanner probed a vulnerable instance 3 hours, 44 minutes, and 39 seconds after disclosure and confirmed a 200 OK on /agents without an Authorization header. The issue lets attackers enumerate and potentially trigger agent workflows, posing a platform-level security risk to internet-facing AI services used by projects and protocols (including crypto, CEX and DeFi stacks); defenders should upgrade to PraisonAI 4.6.34, bind the server to 127.0.0.1, enable --api-key, and monitor /agents, /chat and reconnaissance indicators like /praisonai/version.txt.

See what traders are focused on

On May 11, 2026, at 13:56 UTC, a GitHub advisory was published detailing a critical vulnerability in the PraisonAI multi-agent orchestration framework. Exactly 3 hours, 44 minutes, and 39 seconds later, the first targeted probe hit a vulnerable instance.

The vulnerability, tracked as CVE-2026-44338 , carries a CVSS score of 7.3. It is a classic CWE-306 (Missing Authentication for Critical Function) flaw, compounded by CWE-668 and CWE-1188 . The root cause is located in the legacy Flask API server within the PraisonAI Python package, specifically in src/praisonai/api_server.py. In affected versions 2.5.6 through 4.6.33, the variables AUTH_ENABLED and AUTH_TOKEN are hard-coded to False and None, respectively. Consequently, the check_auth() function returns True by default, rendering authentication entirely optional.

The reconnaissance activity observed shortly after the advisory publication provides a clear view of how automated scanners operate in this space. Using the User-Agent “CVE-Detector/1.0” from a DigitalOcean IP address (146.190.133.49), the scanner executed two distinct passes separated by eight minutes. The first pass targeted generic paths like /.env and /admin, while the second focused on AI-agent specific surfaces, including /praisonai/version.txt and /api/agents. The scanner successfully confirmed the bypass with a single GET request to /agents, which returned a 200 OK status without requiring an Authorization header. Notably, the scanner did not attempt to trigger the /chat endpoint, suggesting the initial objective was mapping the attack surface rather than immediate exploitation.

The impact of this vulnerability is bounded by the capabilities defined in the operator’s agents.yaml workflow. While not an arbitrary code execution vulnerability in the traditional sense, the unconditional authentication bypass allows unauthorized actors to enumerate configured agents and potentially trigger workflows. This pattern of trust-through-defaults has been observed at the platform or protocol layer, as seen in recent discussions regarding Azure AI Foundry , MCP SDK OAuth implementations , the CARBONATO botnet , and the SalesBleed incident . With CVE-2026-44338, this pattern has migrated into the orchestration framework layer itself, where developers often prioritize ease of use over secure-by-default configurations.

Trey Ford, Chief Strategy and Trust Officer at Bugcrowd, notes that organizations accelerating AI agent adoption without auditing network binding, authentication defaults, and credential exposure in configuration files now face risks they likely have not quantified. This sentiment is echoed by Vineeta Sangaraju, an AI Research Engineer at Black Duck, who emphasizes that any AI service reachable from the internet should be treated as a production asset with rigorous controls around authentication, network segmentation, and monitoring.

Michael Clark, Director of Threat Research at Sysdig, points out that adversary tooling has scaled to the entire AI and agent ecosystem, regardless of project size. The operating assumption for any project shipping an unauthenticated default must be that the window between disclosure and active exploitation is measured in single-digit hours. These observations are based on available security data; there is no evidence of widespread exploitation beyond this initial reconnaissance phase.

For defenders, the remediation path is straightforward: upgrade to PraisonAI version 4.6.34 or later. The newer “serve agents” command in the framework correctly binds to 127.0.0.1 and supports –api-key, addressing the insecure defaults of the legacy server. In the interim, security teams should monitor for requests to /agents and /chat that lack an Authorization header. Additionally, anomalous access to files such as /praisonai/version.txt, pyproject.toml, or requirements.txt should be treated as indicators of reconnaissance.

OpenAI Misalignment Reports Portal: DNS Sandbox Escape & The 2.5-Hour Gap

AI Agent Swarm Mass-Exploited 440 PaperCut Instances in 48 Countries-and Ignored Its Operators’ Exclusion List