PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of Disclosure

🗓️ 14 May 2026 11:40:00Reported by The Hacker NewsType

PraisonAI CVE-2026-44338 allows unauthenticated access to /agents and /chat via legacy Flask API.

Reporter	Title	Published	Views	Family All 29
GithubExploit	Exploit for Insecure Default Initialization of Resource in Praison Praisonai	15 May 202601:38	–	githubexploit
GithubExploit	Exploit for Insecure Default Initialization of Resource in Praison Praisonai	15 May 202608:43	–	githubexploit
ATTACKERKB	CVE-2026-44338	8 May 202613:35	–	attackerkb
BDU FSTEC	The vulnerability of the PraisonAI framework, related to the lack of authentication for critical functions, allows attackers to gain unauthorized access to protected information.	9 Jun 202600:00	–	bdu_fstec
Circl	CVE-2026-44338	3 May 202605:26	–	circl
CNNVD	PraisonAI 访问控制错误漏洞	8 May 202600:00	–	cnnvd
CVE	CVE-2026-44338	8 May 202613:35	–	cve
Cvelist	CVE-2026-44338 PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution	8 May 202613:35	–	cvelist
EUVD	EUVD-2026-28641	8 May 202613:35	–	euvd
Github Security Blog	PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete	25 Aug 202615:14	–	github