PraisonAI AgentOS - Information Disclosure

PraisonAI's AgentOS FastAPI application server exposes an unauthenticated GET /api/agents endpoint that lists every registered agent's name, role and the opening of its instructions system prompt. No authentication is enforced on the route, allowing a remote attacker to enumerate agent...

5mghost-rover (>=0.0.1, <=0.0.3), ace-framework (>=0.6.0, <=0.7.3) +243 more potentially affected by CVE-2026-119204 via pypdf (>=6.0.0, <=6.21.3)

pypdf PYPI version =6.0.0, =0.0.1, =0.6.0, =0.1.0, =0.0.2, =0.1.0, =0.0.24, =0.0.0, =1.1.0, =0.1.2, =0.0.1.dev0, =1.0.0a3, =0.1.3, =0.1.8 and more Source cves: CVE-2026-119204 Source advisory: GHSA-CGGF-277G-3Q54...

5mghost-rover (>=0.0.1, <=0.0.3), ace-framework (>=0.6.0, <=0.7.3) +243 more potentially affected by CVE-2026-119205 via pypdf (>=6.0.0, <=6.21.3)

pypdf PYPI version =6.0.0, =0.0.1, =0.6.0, =0.1.0, =0.0.2, =0.1.0, =0.0.24, =0.0.0, =1.1.0, =0.1.2, =0.0.1.dev0, =1.0.0a3, =0.1.3, =0.1.8 and more Source cves: CVE-2026-119205 Source advisory: OSV:GHSA-MFR5-77XH-9J7H...

5mghost-rover (>=0.0.1, <=0.0.3), ace-framework (>=0.6.0, <=0.7.3) +243 more potentially affected by CVE-2026-119205 via pypdf (>=6.0.0, <=6.21.3)

pypdf PYPI version =6.0.0, =0.0.1, =0.6.0, =0.1.0, =0.0.2, =0.1.0, =0.0.24, =0.0.0, =1.1.0, =0.1.2, =0.0.1.dev0, =1.0.0a3, =0.1.3, =0.1.8 and more Source cves: CVE-2026-119205 Source advisory: GHSA-MFR5-77XH-9J7H...

5mghost-rover (>=0.0.1, <=0.0.3), ace-framework (>=0.6.0, <=0.7.3) +238 more potentially affected by CVE-2026-115572 via pypdf (>=6.0.0, <=6.21.1)

pypdf PYPI version =6.0.0, =0.0.1, =0.6.0, =0.1.0, =0.0.2, =0.1.0, =0.0.24, =0.0.0, =1.1.0, =0.1.2, =0.0.1.dev0, =1.0.0a3, =0.1.3, =0.1.8 and more Source cves: CVE-2026-115572 Source advisory: MEND:CVE-2026-115572...

CVE-2026-57116

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls...

CVE-2026-57116 PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls...

EUVD-2026-108894

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls...

CVE-2026-57116 PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls...

CVE-2026-57116

The PraisonAI framework (package praisonai ) contains a critical authentication bypass in its AgentOS FastAPI deployment surface. Affected versions range from 4.2.1 through 4.6.57 , including the publicly reported patched version 4.5.128 . The root cause is that AgentOSConfig and AgentAppConfig d...

CVE-2026-57116 PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls...

Mervin Praison PraisonAI information disclosure vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions from 4.2.1 up to and including 4.6.59. This vulnerability stems from the lack of authentication on the AgentOS FastAPI deployment interface; the chat route directly calls agent.chatrequest.message. Unauthenticated attackers can...

5mghost-rover (>=0.0.1, <=0.0.3), ace-framework (>=0.6.0, <=0.7.3) +224 more potentially affected by CVE-2026-113792 via pypdf (>=6.0.0, <=6.20.0)

pypdf PYPI version =6.0.0, =0.0.1, =0.6.0, =0.1.0, =0.0.2, =0.1.0, =0.0.24, =0.0.0, =1.1.0, =0.1.2, =0.0.1.dev0, =1.0.0a3, =0.1.3, =0.1.8 and more Source cves: CVE-2026-113792 Source advisory: GHSA-QFV9-64JG-MH7P...

5mghost-rover (>=0.0.1, <=0.0.3), ace-framework (>=0.6.0, <=0.7.3) +224 more potentially affected by CVE-2026-113794 via pypdf (>=6.0.0, <=6.19.0)

pypdf PYPI version =6.0.0, =0.0.1, =0.6.0, =0.1.0, =0.0.2, =0.1.0, =0.0.24, =0.0.0, =1.1.0, =0.1.2, =0.0.1.dev0, =1.0.0a3, =0.1.3, =0.1.8 and more Source cves: CVE-2026-113794 Source advisory: GHSA-39MJ-JF6J-2QJ3...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-53995 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2026-53995 Source advisory: OSV:GHSA-WQMH-QCCW-PQWF...

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

Summary The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart new AgentOSagents:....serveport...

NPM: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

NPM: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure vulnerability discovered by ? in WordPress Npm praisonai versions 1.7.3...

GHSA-6WJP-V33H-5CVQ PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

Summary The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart new AgentOSagents:....serveport...

agentos (>=0.1.0, <=0.2.0), symbiont-io-pytest-assembly (>=2.0.2rc0, <=3.1.0.dev4) potentially affected by CVE-2026-114094 via dulwich (0.20.28)

dulwich PYPI version 0.20.28 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - agentos =0.1.0, =2.0.2rc0, =3.1.0.dev4 Source cves: CVE-2026-114094 Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

agentos (>=0.1.0, <=0.2.0), symbiont-io-pytest-assembly (>=2.0.2rc0, <=3.1.0.dev4) potentially affected by CVE-2026-114095 via dulwich (0.20.28)

dulwich PYPI version 0.20.28 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - agentos =0.1.0, =2.0.2rc0, =3.1.0.dev4 Source cves: CVE-2026-114095 Source advisory: OSV:GHSA-35MR-4567-66VG...