{"id":"CVE-2026-57116","kind":"vulnerability","aliases":["CVE-2026-57116"],"related":[],"title":"PraisonAI AgentOS: unauthenticated chat route runs deployed agents","description":"PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.","summary":"PraisonAI's AgentOS FastAPI server accepts chat requests with no or wrong bearer token and passes them straight to the deployed agent. An attacker who can reach the server can drive any agent's tools, memory, API integrations and paid model calls.","severity":"critical","cvss":9.8,"epss":0.00491,"exploited":false,"exploited_at":null,"products":[{"name":"praisonai","fixed":["4.6.59"],"affected":">= 4.2.1, <= 4.6.57","ecosystem":"pip"}],"ecosystems":["pip"],"tags":["agentos","ai-tooling","fastapi","incomplete-fix","missing-auth","praisonai","python","self-hosted"],"not_affected_if":["default-config","not-agentos-deployed"],"how_to_check":"Run pip show praisonai and check whether the version is between 4.2.1 and 4.6.57.\nIf AgentOS is deployed, send a chat request to its chat route with no Authorization header and see whether it answers.","fix":"Upgrade praisonai to 4.6.59 or later.\nUntil then, keep the AgentOS server off public networks and put it behind an authenticating proxy.","status":"open","published_at":"2026-10-23T13:17:10+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-23T22:31:07+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:31:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade praisonai to 4.6.59 or later.\nUntil then, keep the AgentOS server off public networks and put it behind an authenticating proxy.","reach":"network","title":"PraisonAI AgentOS: unauthenticated chat route runs deployed agents","impact":"high","summary":"PraisonAI's AgentOS FastAPI server accepts chat requests with no or wrong bearer token and passes them straight to the deployed agent. An attacker who can reach the server can drive any agent's tools, memory, API integrations and paid model calls.","category":"ai-tooling","who_cares":["python","praisonai","fastapi","self-hosted","agentos"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote clients run deployed agents, reaching tools, memory and paid model calls","analyst_note":"Confirm the exact chat route path and whether the fix in 4.6.59 covers the same route, per the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-57116.","how_to_check":"Run pip show praisonai and check whether the version is between 4.2.1 and 4.6.57.\nIf AgentOS is deployed, send a chat request to its chat route with no Authorization header and see whether it answers.\nunknown for the exact route path, as the sources do not give it.","needs_analyst":true,"not_affected_if":["default-config","not-agentos-deployed"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000576,"input_tokens":3109,"output_tokens":530,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact AgentOS route paths and config that enable the FastAPI deployment, and check the GHSA-pm96-6xpr-978x advisory referenced in the description for detection steps.","search":"'-2026':10A,13A,115C '-40151':116C '-57116':11A,14A '4.2.1':84C '4.6.59':88C,179C '6xpr':112C '978x':113C 'accept':37B 'agent':8A,53B,64B,79C,136C,150C,171C 'agent.chat':122C 'agento':2A,16B,34B,91C,148C 'ai':18B 'ai-tool':17B 'api':68B,156C 'attack':55B 'auth':26B,126C 'bear':161C 'bearer':44B,130C 'broader':139C 'call':73B,121C,163C 'chat':4A,38B,118C 'client':167C 'context':154C 'cost':160C 'cost-bear':159C 'current':98C 'cve':9A,12A,114C 'deploy':7A,52B,93C,135C,146C 'direct':120C 'disclosur':143C 'drive':62B,169C 'execut':133C 'fastapi':20B,35B,92C 'fix':23B 'ghsa':110C 'ghsa-pm96-6xpr-978x':109C 'host':31B 'incomplet':22B 'incomplete-fix':21B 'integr':69B,157C 'issu':173C 'main':99C 'memori':67B,155C 'metadata':142C 'miss':25B 'missing-auth':24B 'model':72B,162C 'multi':78C 'multi-ag':77C 'no-auth':124C 'paid':71B 'pass':47B 'passiv':141C 'patch':106C,176C 'pm96':111C 'praisonai':1A,15A,27B,32B,74C,89C 'privat':153C 'publish':105C 'python':28B 'reach':58B 'reachabl':166C 'releas':102C 'remain':95C 'request':39B,131C 'request.message':123C 'rout':5A,119C 'run':6A 'self':30B 'self-host':29B 'server':36B,60B 'straight':49B 'surfac':94C 'system':81C 'team':80C 'token':45B 'tool':19B,66B,152C 'unauthent':3A,96C,165C 'version':83C,87C,107C,178C 'wrap':149C 'wrong':43B,129C 'wrong-bear':128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-57116","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57116","severity":null,"published_at":"2026-10-23T13:17:10+00:00","modified_at":"2026-10-23T13:17:10+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-57116:157","url":null,"severity":null,"published_at":"2026-10-23T22:02:52+00:00","modified_at":"2026-10-23T22:02:52+00:00","first_seen_at":"2026-10-23T22:02:52+00:00","fetched_at":"2026-10-23T22:02:52+00:00","note":"Read primary GHSA-892r-p3jq-jp24 (reporter's PoV, local only; no in-the-wild exploitation found). Incomplete fix of CVE-2026-40151: GET /api/agents and POST /api/chat unauthenticated, default host 0.0.0.0 port 8000 prefix /api. Affected >=4.2.1,<=4.6.57; 4.6.58 not addressed by advisory (unknown). X chatter negligible."},{"source":"epss","external_id":"CVE-2026-57116","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57116","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":1283,"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-892r-p3jq-jp24","title":"GHSA-892r-p3jq-jp24 AgentOS remains unauthenticated (CVE-2026-57116)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1283,"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-892r-p3jq-jp24","title":"GHSA-892r-p3jq-jp24 AgentOS remains unauthenticated (CVE-2026-57116)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1284,"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pm96-6xpr-978x","title":"GHSA-pm96-6xpr-978x AgentOS /api/agents disclosure (CVE-2026-40151), original incomplete fix","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1285,"url":"https://security.snyk.io/vuln/SNYK-PYTHON-PRAISONAI-17660619","title":"Snyk: Missing Authorization in praisonai","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}