CVE-2026-57132: Improper Authentication

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAICALLAUTH to disabled makes verifytoken accept requests to /api/v1/agents/id/invoke without CALLSERVERTOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their...

Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit

The /v1/chat/agents/agentid/edit endpoint in local-operator versions before 0.47.5 resolves the caller-supplied filepath with expanduser.resolve and reads it without checking that it lies inside the agent's workspace. An unauthenticated client with network access to the API can supply an absolute...

CVE-2026-55541

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but createagentsapp and createunifiedapp do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/id/invoke. This...

CVE-2026-55541: Missing Authorization

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but createagentsapp and createunifiedapp do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/id/invoke. This...

PT-2026-35291

Summary The GET, POST, and DELETE handlers under /agents/:id/keys in the Paperclip control-plane API only call assertBoardreq, which verifies that the caller has a board-type session but does not verify that the caller has access to the company owning the target agent. A board user whose membersh...

SmarterTools SmarterTrack 7922 Information Disclosure

Exploit Title: SmarterTools SmarterTrack 7922 - 'Multiple' Information Disclosure Google Dork: intext:"Powered by SmarterTrack" Date: 23/01/2020 Exploit Author: Andrei Manole Vendor Homepage: https://www.smartertools.com/ Software Link: https://www.smartertools.com/smartertrack Version: TESTED ON...