---
id: "CVE-2026-57116"
kind: "vulnerability"
aliases: ["CVE-2026-57116"]
title: "PraisonAI AgentOS: unauthenticated chat route runs deployed agents"
severity: "critical"
cvss: 9.8
epss: 0.00491
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "praisonai", "fixed": ["4.6.59"], "affected": ">= 4.2.1, <= 4.6.57", "ecosystem": "pip"}]
ecosystems: ["pip"]
tags: ["agentos", "ai-tooling", "fastapi", "incomplete-fix", "missing-auth", "praisonai", "python", "self-hosted"]
not_affected_if: ["default-config", "not-agentos-deployed"]
published_at: "2026-10-23T13:17:10+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57116", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:02:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-57116", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# PraisonAI AgentOS: unauthenticated chat route runs deployed agents

PraisonAI's AgentOS FastAPI server accepts chat requests with no or wrong bearer token and passes them straight to the deployed agent. An attacker who can reach the server can drive any agent's tools, memory, API integrations and paid model calls.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:praisonai affected >= 4.2.1, <= 4.6.57 fixed 4.6.59

## How to check

Run pip show praisonai and check whether the version is between 4.2.1 and 4.6.57.
If AgentOS is deployed, send a chat request to its chat route with no Authorization header and see whether it answers.

## Fix

Upgrade praisonai to 4.6.59 or later.
Until then, keep the AgentOS server off public networks and put it behind an authenticating proxy.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57116
- 2026-10-23T22:02:52+00:00 analyst — Read primary GHSA-892r-p3jq-jp24 (reporter's PoV, local only; no in-the-wild exploitation found). Incomplete fix of CVE-2026-40151: GET /api/agents and POST /api/chat unauthenticated, default host 0.0.0.0 port 8000 prefix /api. Affected >=4.2.1,<=4.6.57; 4.6.58 not addressed by advisory (unknown). X chatter negligible.
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-57116

## Documents

- [advisory] GHSA-892r-p3jq-jp24 AgentOS remains unauthenticated (CVE-2026-57116) https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-892r-p3jq-jp24
- [describes] GHSA-pm96-6xpr-978x AgentOS /api/agents disclosure (CVE-2026-40151), original incomplete fix https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pm96-6xpr-978x
- [mentions] Snyk: Missing Authorization in praisonai https://security.snyk.io/vuln/SNYK-PYTHON-PRAISONAI-17660619
- [poc] GHSA-892r-p3jq-jp24 AgentOS remains unauthenticated (CVE-2026-57116) https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-892r-p3jq-jp24

## From the sources

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_