CVE-2026-61426

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.

Summary

The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS * with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart (new AgentOS({agents:[...]}).serve({port})) exposes, unauthenticated, GET /api/agents (which leaks agent names/roles/instructions, i.e. system prompts) and POST /api/chat (which invokes agents). Any network peer can read agent system prompts and drive the agent. Runtime-confirmed; severity High.

Details

Affected component

• Package: praisonai (npm / TypeScript). Files src/praisonai-ts/src/os/config.ts and src/praisonai-ts/src/os/agentos.ts (AgentOS).

Vulnerable code / root cause

Path: src/praisonai-ts/src/os/config.ts

Class/const: DEFAULT_AGENTOS_CONFIG / mergeConfig

Snippet:

export const DEFAULT_AGENTOS_CONFIG = {
  host: '0.0.0.0',
  corsOrigins: ['*'],
  apiKey: '',
  // ...
};
// mergeConfig: apiKey = userConfig?.apiKey ?? process.env.PRAISONAI_AGENTOS_API_KEY ?? '';

Issue: defaults bind all interfaces, with an empty API key and wildcard CORS. apiKey stays empty unless the developer explicitly sets it.

Path: src/praisonai-ts/src/os/agentos.ts

Function: serve / _registerRoutes (Express app)

Snippet:

if (this.config.apiKey) {              // auth middleware ONLY added when apiKey is set
  app.use((req,res,next) => { /* 401 unless Bearer/x-auth-token matches */ });
}
// routes:
app.get(`${apiPrefix}/agents`, ...)    // returns name/role/instructions
app.post(`${apiPrefix}/chat`,  ...)    // calls agent.chat(message)

Issue: the only auth gate is conditional on a non-empty apiKey. With the default empty key, no auth middleware is registered, and GET /api/agents (system-prompt disclosure) and POST /api/chat (agent invocation) are served to any network client. CORS sets Access-Control-Allow-Credentials: true with a wildcard origin.

Attack flow

1. Developer deploys AgentOS via the quickstart without setting apiKey/PRAISONAI_AGENTOS_API_KEY.
2. Any network peer calls GET /api/agents → receives agent instructions/system prompts.
3. Any network peer calls POST /api/chat → invokes the agent.

Why existing protection is bypassed

There is no protection in the default config — the auth gate is skipped when apiKey is empty (the default), and the server binds all interfaces.

Security boundary

Unauthenticated network access to agent metadata + invocation. This is the CVE-2026-44338 anti-pattern recurring in the TS package, and worse (0.0.0.0 is the default).

Proof of Concept

Environment

Real AgentOS from src/praisonai-ts run via ts-node in a node container with default config (stub agent, no LLM needed). 127.0.0.1:18000. Runnable assets: PraisonAI-Runtime-Repro\runtime-files\ (docker-compose.agentos.yml).

Steps to reproduce

1. PRAI-01-01-AgentOS-Agents-NoAuth: GET /api/agents (no Authorization) → 127.0.0.1:18000.
2. PRAI-01-02-AgentOS-Chat-NoAuth: POST /api/chat {"message":"hello from attacker"} (no Authorization).

Expected result

Non-loopback exposure should require authentication; agent instructions should not be disclosed unauthenticated.

Actual result

• GET /api/agents → 200, leaks "instructions":"SYSTEM PROMPT SECRET ... PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91"; response header Access-Control-Allow-Credentials: true.
• POST /api/chat → 200, agent invoked ("response":"...PRAISONAI_AGENTOS_CANARY_7f3a91...").

Screenshots

Unauthenticated /api/agents leaks agent instructions

A GET request to /api/agents succeeds without an Authorization header. The response exposes agent metadata and instructions, including the canary system-prompt value.

<img width="1535" height="829" alt="01-AgentOS-Agents-NoAuth"…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6wjp-v33h-5cvq. This link is maintained to preserve external references.

Original Description

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.

Summary

The AgentOS server in the praisonai TypeScript/npm package ships an insecure default: it binds 0.0.0.0, sets no API key, and uses CORS * with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart (new AgentOS({agents:[...]}).serve({port})) exposes, unauthenticated, GET /api/agents (which leaks agent names/roles/instructions, i.e. system prompts) and POST /api/chat (which invokes agents). Any network peer can read agent system prompts and drive the agent. Runtime-confirmed; severity High.

Details

Affected component

• Package: praisonai (npm / TypeScript). Files src/praisonai-ts/src/os/config.ts and src/praisonai-ts/src/os/agentos.ts (AgentOS).

Vulnerable code / root cause

Path: src/praisonai-ts/src/os/config.ts

Class/const: DEFAULT_AGENTOS_CONFIG / mergeConfig

Snippet:

export const DEFAULT_AGENTOS_CONFIG = {
  host: '0.0.0.0',
  corsOrigins: ['*'],
  apiKey: '',
  // ...
};
// mergeConfig: apiKey = userConfig?.apiKey ?? process.env.PRAISONAI_AGENTOS_API_KEY ?? '';

Issue: defaults bind all interfaces, with an empty API key and wildcard CORS. apiKey stays empty unless the developer explicitly sets it.

Path: src/praisonai-ts/src/os/agentos.ts

Function: serve / _registerRoutes (Express app)

Snippet:

if (this.config.apiKey) {              // auth middleware ONLY added when apiKey is set
  app.use((req,res,next) => { /* 401 unless Bearer/x-auth-token matches */ });
}
// routes:
app.get(`${apiPrefix}/agents`, ...)    // returns name/role/instructions
app.post(`${apiPrefix}/chat`,  ...)    // calls agent.chat(message)

Issue: the only auth gate is conditional on a non-empty apiKey. With the default empty key, no auth middleware is registered, and GET /api/agents (system-prompt disclosure) and POST /api/chat (agent invocation) are served to any network client. CORS sets Access-Control-Allow-Credentials: true with a wildcard origin.

Attack flow

1. Developer deploys AgentOS via the quickstart without setting apiKey/PRAISONAI_AGENTOS_API_KEY.
2. Any network peer calls GET /api/agents → receives agent instructions/system prompts.
3. Any network peer calls POST /api/chat → invokes the agent.

Why existing protection is bypassed

There is no protection in the default config — the auth gate is skipped when apiKey is empty (the default), and the server binds all interfaces.

Security boundary

Unauthenticated network access to agent metadata + invocation. This is the CVE-2026-44338 anti-pattern recurring in the TS package, and worse (0.0.0.0 is the default).

Proof of Concept

Environment

Real AgentOS from src/praisonai-ts run via ts-node in a node container with default config (stub agent, no LLM needed). 127.0.0.1:18000. Runnable assets: PraisonAI-Runtime-Repro\runtime-files\ (docker-compose.agentos.yml).

Steps to reproduce

1. PRAI-01-01-AgentOS-Agents-NoAuth: GET /api/agents (no Authorization) → 127.0.0.1:18000.
2. PRAI-01-02-AgentOS-Chat-NoAuth: POST /api/chat {"message":"hello from attacker"} (no Authorization).

Expected result

Non-loopback exposure should require authentication; agent instructions should not be disclosed unauthenticated.

Actual result

• GET /api/agents → 200, leaks "instructions":"SYSTEM PROMPT SECRET ... PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91"; response header Access-Control-Allow-Credentials: true.
• POST /api/chat → 200, agent invoked ("response":"...PRAISONAI_AGENTOS_CANARY_7f3a91...").

Screenshots

Unauthenticated /api/agents leaks agent instructions

A GET request to /api/agents succeeds without an Authorization header. The response exposes agent metadata and instructions, including the canary system-prompt value.

<img width="1535" height="829" alt="01-AgentOS-Agents-NoAuth"…

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6wjp-v33h-5cvq. This link is maintained to preserve external references.

Original Description

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.