CVE-2026-57140

PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authentication middleware. A remote caller who can reach the service can obtain agent names, roles, and instruction prefixes and can invoke a selected agent, potentially reaching its tools, memory, external APIs, credentials, and workflow state. An initial remediation was released in version 1.7.2.

PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authentication middleware. A remote caller who can reach the service can obtain agent names, roles, and instruction prefixes and can invoke a selected agent, potentially reaching its tools, memory, external APIs, credentials, and workflow state. An initial remediation was released in version 1.7.2.

Summary

The published npm package praisonai ships a TypeScript AgentOS HTTP server that defaults to host: "0.0.0.0" and registers sensitive agent routes without any authentication or authorization middleware.

When a developer starts AgentOS, a network attacker who can reach the service can:

• read configured agent names, roles, and the first 100 characters of each agent's instructions through GET /api/agents; and
• invoke the selected agent through POST /api/chat without credentials.

This is distinct from the existing Python/PyPI AgentOS and API-server advisories. The affected package here is npm:praisonai; the current published npm package is 1.7.1, and the same TypeScript source is still present in refreshed origin/main at v4.6.58.

Technical Details

AgentOSConfig exposes host, CORS, and API-prefix settings but no authentication token, auth mode, or authorization callback.

Relevant current-head source:

src/praisonai-ts/src/os/config.ts
  26: host?: string;              // default: "0.0.0.0"
  35: corsOrigins?: string[];     // default: ["*"]
  66: export const DEFAULT_AGENTOS_CONFIG = {
  68:     host: '0.0.0.0',
  71:     corsOrigins: ['*'],

AgentOS._createApp() registers JSON parsing and CORS handling, then immediately registers routes. There is no middleware between body parsing and route registration that validates an API key, bearer token, session, origin-bound secret, or any other credential.

Relevant current-head source:

src/praisonai-ts/src/os/agentos.ts
  179: app.use(express.json());
  182: // Add CORS middleware
  204: // Register routes
  205: this._registerRoutes(app);

The sensitive routes are then exposed:

src/praisonai-ts/src/os/agentos.ts
  235: app.get(`${apiPrefix}/agents`, ...)
  240: instructions: agent.instructions ? ... : null
  250: app.post(`${apiPrefix}/chat`, ...)
  273: const response = await agent.chat(message);
  331: const host = options.host || this.config.host;
  338: this._server = app.listen(port, host, ...)

Because the default host is 0.0.0.0, await app.serve({ port: 8000 }) listens on all interfaces unless the developer explicitly overrides host.

Why This Is Not Intended Behavior

PraisonAI's official TypeScript documentation describes the npm package as a production-ready multi-agent framework and directs users to install it with npm install praisonai.

PraisonAI's security documentation says security reports should include affected versions, impact, reproduction steps, and a suggested fix, and states that GitHub Security Advisories are the preferred reporting method. The same security page also documents a prior hardening change where API servers were changed to require authentication by default and bind to 127.0.0.1 instead of 0.0.0.0.

The TypeScript npm AgentOS implementation still does the opposite:

• default bind address is 0.0.0.0;
• no auth config exists in AgentOSConfig;
• /api/agents discloses agent metadata and instruction prefixes; and
• /api/chat invokes agent.chat(message) directly.

The patched-control branch in the PoV confirms that adding a pre-route bearer-token middleware makes the same unauthenticated requests fail with 401.

PoV

The PoV installs the published npm package in a temporary project, starts AgentOS on 127.0.0.1 with a mock agent, and sends loopback HTTP requests. It does not call any LLM provider or external service after package installation.

Run from a local reproduction checkout:

node poc/pov_poc.js 1.7.1

Observed result:

{
  "version": "1.7.1",
  "defaultHost": "0.0.0.0",
  "agentsStatus": 200,
  "agentsBody": {
    "agents": [
      {
        "name": "finance-admin",
        "role": "internal finance operations",
        "instructions": "poc SECRET: refund-wire-tool may alter customer balances"
      }
    ]
  },
  "chatStatus": 200,
  "chatBody": {
    "response": "agent-invoked:transfer-check",
   …

PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authentication middleware. A remote caller who can reach the service can obtain agent names, roles, and instruction prefixes and can invoke a selected agent, potentially reaching its tools, memory, external APIs, credentials, and workflow state. An initial remediation was released in version 1.7.2.

PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authentication middleware. A remote caller who can reach the service can obtain agent names, roles, and instruction prefixes and can invoke a selected agent, potentially reaching its tools, memory, external APIs, credentials, and workflow state. An initial remediation was released in version 1.7.2.

Summary

The published npm package praisonai ships a TypeScript AgentOS HTTP server that defaults to host: "0.0.0.0" and registers sensitive agent routes without any authentication or authorization middleware.

When a developer starts AgentOS, a network attacker who can reach the service can:

• read configured agent names, roles, and the first 100 characters of each agent's instructions through GET /api/agents; and
• invoke the selected agent through POST /api/chat without credentials.

This is distinct from the existing Python/PyPI AgentOS and API-server advisories. The affected package here is npm:praisonai; the current published npm package is 1.7.1, and the same TypeScript source is still present in refreshed origin/main at v4.6.58.

Technical Details

AgentOSConfig exposes host, CORS, and API-prefix settings but no authentication token, auth mode, or authorization callback.

Relevant current-head source:

src/praisonai-ts/src/os/config.ts
  26: host?: string;              // default: "0.0.0.0"
  35: corsOrigins?: string[];     // default: ["*"]
  66: export const DEFAULT_AGENTOS_CONFIG = {
  68:     host: '0.0.0.0',
  71:     corsOrigins: ['*'],

AgentOS._createApp() registers JSON parsing and CORS handling, then immediately registers routes. There is no middleware between body parsing and route registration that validates an API key, bearer token, session, origin-bound secret, or any other credential.

Relevant current-head source:

src/praisonai-ts/src/os/agentos.ts
  179: app.use(express.json());
  182: // Add CORS middleware
  204: // Register routes
  205: this._registerRoutes(app);

The sensitive routes are then exposed:

src/praisonai-ts/src/os/agentos.ts
  235: app.get(`${apiPrefix}/agents`, ...)
  240: instructions: agent.instructions ? ... : null
  250: app.post(`${apiPrefix}/chat`, ...)
  273: const response = await agent.chat(message);
  331: const host = options.host || this.config.host;
  338: this._server = app.listen(port, host, ...)

Because the default host is 0.0.0.0, await app.serve({ port: 8000 }) listens on all interfaces unless the developer explicitly overrides host.

Why This Is Not Intended Behavior

PraisonAI's official TypeScript documentation describes the npm package as a production-ready multi-agent framework and directs users to install it with npm install praisonai.

PraisonAI's security documentation says security reports should include affected versions, impact, reproduction steps, and a suggested fix, and states that GitHub Security Advisories are the preferred reporting method. The same security page also documents a prior hardening change where API servers were changed to require authentication by default and bind to 127.0.0.1 instead of 0.0.0.0.

The TypeScript npm AgentOS implementation still does the opposite:

• default bind address is 0.0.0.0;
• no auth config exists in AgentOSConfig;
• /api/agents discloses agent metadata and instruction prefixes; and
• /api/chat invokes agent.chat(message) directly.

The patched-control branch in the PoV confirms that adding a pre-route bearer-token middleware makes the same unauthenticated requests fail with 401.

PoV

The PoV installs the published npm package in a temporary project, starts AgentOS on 127.0.0.1 with a mock agent, and sends loopback HTTP requests. It does not call any LLM provider or external service after package installation.

Run from a local reproduction checkout:

node poc/pov_poc.js 1.7.1

Observed result:

{
  "version": "1.7.1",
  "defaultHost": "0.0.0.0",
  "agentsStatus": 200,
  "agentsBody": {
    "agents": [
      {
        "name": "finance-admin",
        "role": "internal finance operations",
        "instructions": "poc SECRET: refund-wire-tool may alter customer balances"
      }
    ]
  },
  "chatStatus": 200,
  "chatBody": {
    "response": "agent-invoked:transfer-check",
   …