PYSEC-2026-3507: PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments running PraisonAI from version 4.2.1 through versions before 4.6.59 are affected if their AgentOS FastAPI surface is reachable by an unauthenticated client. The risk is especially significant where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls.
What does an attacker need to exploit the issue?
An attacker only needs network access to the deployed AgentOS chat route. No authentication is required: both requests without authentication and requests with an incorrect bearer token can execute the deployed agent.
What can an unauthenticated caller do?
The caller can invoke the deployed agent through the chat route, which directly calls agent.chat(request.message). Depending on the agent configuration, this can drive tools, access private context or memory, use API integrations, and trigger model calls that incur cost.
How can I determine whether my deployment is affected?
Check whether the deployment uses a PraisonAI version from 4.2.1 to before 4.6.59 and exposes the AgentOS FastAPI chat route to clients that are not authenticated. Affected deployments execute the agent for both unauthenticated requests and requests carrying an incorrect bearer token.
What version fixes the issue?
The issue is patched in PraisonAI version 4.6.59.