CVE-2026-57118: PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and POST /{path}/{agentid}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaiagentsto a version that resolves this vulnerability.Fixed in 1.6.59
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated remote use?
A remotely exposed server running a vulnerable praisonaiagents version is exposed when it uses AgentTeam.launch or the Agents alias. The affected endpoints allow remote clients to list agents and invoke agent.chat without access-control checks.
What does an attacker need to exploit this issue?
The attacker needs network access to the exposed server endpoints. No authentication, privileges, or user interaction are required.
What could an unauthenticated caller do through the exposed endpoints?
They can enumerate agents, invoke agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects.
What version fixes the issue?
The issue is fixed in praisonaiagents 1.6.59. Versions prior to 1.6.59 are affected.
How can I identify whether my deployment is affected?
Check whether the installed praisonaiagents version is earlier than 1.6.59 and whether AgentTeam.launch or the Agents alias is serving endpoints reachable by untrusted remote clients. Relevant routes include GET /{path}/list, POST /{path}, and POST /{path}/{agent_id}.