CVE-2026-57116: PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running PraisonAI AgentOS versions 4.2.1 through before 4.6.59 are affected if the AgentOS FastAPI surface is reachable by an unauthenticated client. Exposure is especially consequential where deployed agents have tools, private context, memory, API integrations, or cost-bearing model access.
Does an attacker need credentials or a valid bearer token?
No. The affected chat route executes the deployed agent without authentication, and requests with an incorrect bearer token also execute the agent. An attacker only needs network reachability to the AgentOS deployment.
What can an unauthenticated client do?
An unauthenticated client can invoke the deployed agent through the chat route. Depending on the agent configuration, this can drive tool use, access workflows involving private context or memory, invoke API integrations, and generate model-call costs.
How can this be remediated?
Upgrade to PraisonAI version 4.6.59, which patches this issue. If upgrading cannot occur immediately, restrict network access to the AgentOS FastAPI deployment so unauthenticated clients cannot reach it.