CVE-2026-56076: PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: headers, combined with Starlette's Content-Type-agnostic JSON parsing, enabling attackers to bypass CORS preflight checks via simple requests and exfiltrate sensitive agent responses including tool execution results and environment data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 1.5.128 - Configuration
Require authentication on the POST /agui endpoint so remote attackers cannot trigger agent execution without valid credentials.
PraisonAI AGUI endpoint (/agui) authentication = required - Configuration
Remove the hardcoded Access-Control-Allow-Origin: * response header on the /agui endpoint and configure CORS to allow only explicitly authorized origins.
PraisonAI AGUI endpoint (/agui) Access-Control-Allow-Origin = not * - Compensating control
If CORS must be permissive for compatibility, add an external compensating control (e.g., restrict which origins can reach the AGUI endpoint via network allowlisting/WAF/ACL) to limit cross-origin access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56076?
The severity of CVE-2026-56076 is high, with a CVSS score of 8.1.
How do I fix CVE-2026-56076?
To fix CVE-2026-56076, update to PraisonAI version 1.5.128 or later, which addresses the cross-origin agent execution vulnerability.
What are the potential impacts of CVE-2026-56076?
CVE-2026-56076 can allow remote attackers to execute arbitrary agents due to missing authentication and hardcoded wildcard CORS settings.
Which component is affected by CVE-2026-56076?
The affected component of CVE-2026-56076 is the AGUI endpoint in PraisonAI.
What actions can attackers perform due to CVE-2026-56076?
Attackers can exploit CVE-2026-56076 to trigger arbitrary agent execution without authentication.