# PraisonAI Auth Bypass Exploited Within Hours—What Developers Need to Know


## The Threat


PraisonAI, a popular open-source multi-agent orchestration framework, shipped with a critical authentication flaw that left deployed instances vulnerable to complete takeover within minutes of public disclosure. The vulnerability, tracked as CVE-2026-44338, stems from a legacy Flask API server that ships with authentication disabled by default—a dangerous design choice that exposes sensitive endpoints to anyone with network access.


The flaw allows unauthenticated attackers to directly access two critical endpoints: /agents (which enumerates the configured workflow file) and /chat (which executes agent workflows). An attacker with network connectivity to a vulnerable instance can trigger arbitrary agent actions, drain API quotas, and steal the results of AI model invocations—all without any credentials or tokens. According to the PraisonAI maintainers, the Flask server's source code hard-codes AUTH_ENABLED = False and AUTH_TOKEN = None, making the vulnerability unconditional across all affected versions.


The concerning part isn't just that the flaw exists—it's the speed at which attackers moved to exploit it. Within three hours and 44 minutes of the advisory going public, security researchers observed active exploitation attempts targeting internet-exposed PraisonAI instances.


## Severity and Impact


| Field | Details |

|-------|---------|

| CVE Identifier | CVE-2026-44338 |

| CVSS Score | 7.3 (High) |

| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |

| Attack Complexity | Low |

| Authentication Required | None |

| CWE | CWE-306 (Missing Authentication for Critical Function) |

| Attack Vector | Network |

| Scope | Unchanged |


Potential Impacts:

  • Unauthenticated enumeration of configured agents and workflows via /agents endpoint
  • Triggering of arbitrary agent workflows through /chat without credentials
  • Unauthorized consumption of model API quotas and billing fraud
  • Exposure of sensitive data (model outputs, internal workflow results) to attackers
  • Potential lateral movement if agents are configured to interact with backend systems

    • ## Affected Products


    PraisonAI Python Package:

  • Versions 2.5.6 through 4.6.33 (all versions shipped with vulnerable legacy Flask server)
  • Fixed in: Version 4.6.34 and later
  • Component affected: src/praisonai/api_server.py

    • Users running any version between 2.5.6 and 4.6.33 must assume their deployments are potentially compromised if internet-exposed.


    ## Mitigations


    Immediate Actions:


    1. Upgrade PraisonAI immediately to version 4.6.34 or later:

    ```bash

    pip install --upgrade praisonai>=4.6.34

    ```


    2. Network segmentation: If upgrading is not immediately possible, restrict network access to the Flask API server. Deploy it behind a firewall or load balancer that enforces authentication at the gateway level.


    3. Audit deployments: Check for internet-exposed PraisonAI instances. Use tools like shodan or censys to identify public-facing instances, then review logs for suspicious activity dating back to May 11, 2026 (disclosure date).


    4. Rotate credentials: Any API keys, model tokens, or authentication credentials referenced in agents.yaml should be rotated immediately, as they may have been exposed to attackers.


    5. Review billing and quota usage: Check model provider accounts (OpenAI, Anthropic, etc.) for suspicious activity or unexpected consumption patterns since the disclosure date.


    6. Enable authentication in configuration: After upgrading, ensure AUTH_ENABLED = True and set a strong AUTH_TOKEN value in all production deployments.


    7. Monitor agent execution logs: Review logs for any unauthorized /agents or /chat requests originating from unexpected IP addresses.


    ## References


  • Official PraisonAI Advisory: https://github.com/MervinPraison/PraisonAI/security/advisories
  • PraisonAI GitHub Repository: https://github.com/MervinPraison/PraisonAI
  • Sysdig Cloud Security Report: https://sysdig.com/blog/cve-2026-44338-praisonai-exploitation/
  • Researcher Credit: Security researcher Shmulik Cohen

    • ---


    ## HackWire Analysis


    The speed of exploitation in this case is the story. Three hours and 44 minutes from public disclosure to active targeted scanning—this represents a fundamental shift in how rapidly threat actors operationalize newly disclosed flaws. This isn't a nation-state or sophisticated APT; Sysdig's telemetry shows automated scanners immediately probing for the exact vulnerable endpoint, using a generic User-Agent that broadcasts intent (CVE-Detector/1.0).


    What's particularly troubling is that this vulnerability targets developers and small to medium-sized organizations building with open-source AI frameworks. PraisonAI isn't a niche tool—it's a widely-used orchestration layer for teams building multi-agent systems. The default-insecure configuration pattern (shipping with auth disabled) is endemic across the AI tooling ecosystem. If you've deployed an AI framework in the last 18 months without explicitly hardening authentication, assume threat actors are scanning for it.


    The broader pattern: as AI and agent frameworks proliferate, each new project becomes a potential attack surface. The window between disclosure and weaponization has contracted to hours, not days. Organizations can no longer rely on a "patch Tuesday" cadence. The practical implication for defenders is stark—you must assume any unauthenticated endpoint touching AI models or workflows is being actively probed by automated scanners within 24 hours of disclosure.


    For PraisonAI specifically, the fact that the vulnerability is unconditional (it can't be worked around; it must be patched) makes this a critical priority. Any internet-facing instance running versions 2.5.6–4.6.33 should be considered compromised until proven otherwise. Audit your API quotas, rotate your model credentials, and upgrade immediately.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)