PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
- Product
- praisonai
- CVE
- CVE-2026-57116
- Affected
- praisonai >= 4.2.1, <= 4.6.57
- Fixed in
- 4.6.59
Last verified against sources: October 26, 2026
Am I affected?
praisonai: affected praisonai >= 4.2.1, <= 4.6.57. Fixed in 4.6.59.
- Check your version: run
pip show praisonai. Versions >= 4.2.1, <= 4.6.57 of praisonai are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "praisonai>=4.6.59"(first patched version 4.6.59). [1] - Use 0.0.0.0 only behind an authenticating proxy. [1]
- Do not disable auth for production. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. [1]
- v4.5.128, latest release v4.6.57, and current main still register GET /api/agents and POST /api/chat without authentication. [1]
- The chat route directly calls agent.chat(request.message). [1]
- No-auth and wrong-bearer requests both execute the deployed agent. [1]
Impact
- In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. [1]
- Any client that can reach it can enumerate deployed agents through GET /api/agents. [1]
- Any client that can reach it can read agent names, roles, and instruction snippets. [1]
- Any client that can reach it can invoke the default agent or a named agent through POST /api/chat. [1]
What was done
- The public AgentOS advisory is published as an instruction-disclosure issue with affected versions < 4.5.128 and patched version 4.5.128. [1]
- Packages: pip/praisonai affected >= 4.2.1, <= 4.6.57 patched 4.6.59. [1]
- Maintainers can either update GHSA-pm96-6xpr-978x with the corrected affected range and broader impact or publish a separate incomplete-fix advisory. [1]
Sources
- GHSA-892r-p3jq-jp24 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-57116] PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation
Product: praisonai | Affected: praisonai >= 4.2.1, <= 4.6.57 | Fixed in: 4.6.59
Summary: PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/06/cve-2026-57116-praisonaiCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-57116
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.