GHSA-6RMH-7XCM-CPXJ PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

🗓️ 11 May 2026 13:56:16Reported by GoogleType

osv🔗 osv.dev👁 6 Views

Legacy API server ships with authentication disabled by default, enabling unauthenticated access to /agents and /chat

Reporter	Title	Published	Views	Family All 22
GithubExploit	Exploit for Insecure Default Initialization of Resource in Praison Praisonai	15 May 202601:38	–	githubexploit
GithubExploit	Exploit for Insecure Default Initialization of Resource in Praison Praisonai	15 May 202608:43	–	githubexploit
ATTACKERKB	CVE-2026-44338	8 May 202613:35	–	attackerkb
BDU FSTEC	The vulnerability of the PraisonAI framework, related to the lack of authentication for critical functions, allows attackers to gain unauthorized access to protected information.	9 Jun 202600:00	–	bdu_fstec
Circl	CVE-2026-44338	3 May 202605:26	–	circl
CNNVD	PraisonAI 访问控制错误漏洞	8 May 202600:00	–	cnnvd
CVE	CVE-2026-44338	8 May 202613:35	–	cve
Cvelist	CVE-2026-44338 PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution	8 May 202613:35	–	cvelist
EUVD	EUVD-2026-28641	8 May 202613:35	–	euvd
Github Security Blog	PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution	11 May 202613:56	–	github

Source	Link
github	www.github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6rmh-7xcm-cpxj
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44338
github	www.github.com/MervinPraison/PraisonAI

11 May 2026 14:21Current

6Medium risk

Vulners AI Score6

CVSS 3.17.3

EPSS0.26799