Live › vulnerability › CVE-2026-57116
Go to dashboardPraisonAI's AgentOS FastAPI server accepts chat requests with no or wrong bearer token and passes them straight to the deployed agent. An attacker who can reach the server can drive any agent's tools, memory, API integrations and paid model calls.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| praisonai | pip | >= 4.2.1, <= 4.6.57 | 4.6.59 |
pip show praisonai and check whether the version is between 4.2.1 and 4.6.574.6.59 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
This page as .md · .json · in your agent: get_signal("CVE-2026-57116")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.