by Kastro
Paper/Archive/CVE-2026-57118

CVE-2026-57118

MervinPraison PraisonAI — PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.5.355 × 207.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.

Affected

ProductAffectedFixed inSource
PraisonAI< 4.6.59–CNA
praisonaiagents< 1.6.59–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/MervinPraison/PraisonAI/security/advisories/GHSA-x8cv-xmq7-p8xprefgithub.com/MervinPraison/PraisonAI/commit/b4270173d4123fb1ee8910588f0896668ee21b59refgithub.com/MervinPraison/PraisonAI/releases/tag/v4.6.59