CVE-2026-57118

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.

PraisonAI AgentTeam.launch() exposes unauthenticated remote agent invocation endpoints

Summary

PraisonAI's documented Python AgentTeam.launch() / Agents.launch() HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement.

The current implementation registers GET /{path}/list, POST /{path}, and POST /{path}/{agent_id} routes. The POST routes directly call agent.chat(...). Requests with no Authorization header are accepted, and requests with an obviously wrong bearer token are also accepted. The default Python API bind host for Agents.launch() is 0.0.0.0, and official documentation shows host="0.0.0.0" for remote access.

This is a sibling/incomplete-fix variant of PraisonAI's prior unauthenticated API server and call server advisory family. Nearby server surfaces were hardened to require tokens, fail closed, or bind locally by default, but the AgentTeam.launch() FastAPI path still exposes unauthenticated agent execution on current upstream main and the latest release.

This report is scoped to the Python AgentTeam.launch() / Agents.launch() route-registration path. It does not require adjudicating whether the separate praisonai serve agents --api-key CLI path is correctly enforced.

Affected Components

• Package: praisonaiagents
• Current upstream main tested: 2f9677abb2ea68eab864ee8b6a828fd0141612e1
• Latest release tag tested: v4.6.57
• Primary file: src/praisonai-agents/praisonaiagents/agents/agents.py
• Current line references: AgentTeam.launch() begins at line 1923; the group POST route is registered at line 2007; the group handler invokes agent_instance.chat(...) at line 2042; the unauthenticated list route is registered at line 2086; per-agent handlers invoke agent.chat(...) at line 2117.
• Primary class/API: AgentTeam.launch() / exported alias Agents
• Affected routes:
  • GET /{path}/list: lists deployed agents.
  • POST /{path}: sequentially invokes all agents in the team.
  • POST /{path}/{agent_id}: invokes a specific agent.

Current vulnerable sink:

@app.post(path)
async def handle_query(request: Request, query_data: Optional[AgentQuery] = None):
    ...
    response = await loop.run_in_executor(
        None,
        copy_context_to_callable(lambda ci=current_input: agent_instance.chat(ci)),
    )

Per-agent sink:

app.post(agent_path)(create_agent_handler(agent_instance))
...
response = await loop.run_in_executor(
    None,
    copy_context_to_callable(lambda q=query: agent.chat(q)),
)

List endpoint:

@app.get(f"{path}/list")
async def list_agents():
    return {"agents": [{"name": agent.display_name, "id": ...} for agent in self.agents]}

There is no middleware, dependency, token comparison, bearer-token parsing, API-key check, or startup fail-closed guard in this launch path.

Security Boundary

This is not a trust-model-only report. PraisonAI's own current security documentation says API servers were hardened so that anonymous requests return 401 and API servers bind to 127.0.0.1 by default after the prior unauthenticated API advisory family.

The codebase also contains hardened sibling implementations:

• praisonai.deploy.api now has AUTH_ENABLED, PRAISONAI_API_TOKEN, generated tokens, and 401 Unauthorized checks (src/praisonai/praisonai/deploy/api.py lines 44-62 and 69-97).
• praisonai.gateway.server.WebSocketGateway validates external bind safety, requires a token for external binds, checks bearer/query/cookie auth, and validates WebSocket auth (src/praisonai/praisonai/gateway/server.py lines 328-424).
• praisonai call hardening is documented as requiring CALL_SERVER_TOKEN or explicit opt-out.

AgentTeam.launch() remains outside those shared controls even though it exposes the same class of network-facing agent invocation surface.

Local-Only Reproduction

Run the local-only PoV script below with current source…

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.

PraisonAI AgentTeam.launch() exposes unauthenticated remote agent invocation endpoints

Summary

PraisonAI's documented Python AgentTeam.launch() / Agents.launch() HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement.

The current implementation registers GET /{path}/list, POST /{path}, and POST /{path}/{agent_id} routes. The POST routes directly call agent.chat(...). Requests with no Authorization header are accepted, and requests with an obviously wrong bearer token are also accepted. The default Python API bind host for Agents.launch() is 0.0.0.0, and official documentation shows host="0.0.0.0" for remote access.

This is a sibling/incomplete-fix variant of PraisonAI's prior unauthenticated API server and call server advisory family. Nearby server surfaces were hardened to require tokens, fail closed, or bind locally by default, but the AgentTeam.launch() FastAPI path still exposes unauthenticated agent execution on current upstream main and the latest release.

This report is scoped to the Python AgentTeam.launch() / Agents.launch() route-registration path. It does not require adjudicating whether the separate praisonai serve agents --api-key CLI path is correctly enforced.

Affected Components

• Package: praisonaiagents
• Current upstream main tested: 2f9677abb2ea68eab864ee8b6a828fd0141612e1
• Latest release tag tested: v4.6.57
• Primary file: src/praisonai-agents/praisonaiagents/agents/agents.py
• Current line references: AgentTeam.launch() begins at line 1923; the group POST route is registered at line 2007; the group handler invokes agent_instance.chat(...) at line 2042; the unauthenticated list route is registered at line 2086; per-agent handlers invoke agent.chat(...) at line 2117.
• Primary class/API: AgentTeam.launch() / exported alias Agents
• Affected routes:
  • GET /{path}/list: lists deployed agents.
  • POST /{path}: sequentially invokes all agents in the team.
  • POST /{path}/{agent_id}: invokes a specific agent.

Current vulnerable sink:

@app.post(path)
async def handle_query(request: Request, query_data: Optional[AgentQuery] = None):
    ...
    response = await loop.run_in_executor(
        None,
        copy_context_to_callable(lambda ci=current_input: agent_instance.chat(ci)),
    )

Per-agent sink:

app.post(agent_path)(create_agent_handler(agent_instance))
...
response = await loop.run_in_executor(
    None,
    copy_context_to_callable(lambda q=query: agent.chat(q)),
)

List endpoint:

@app.get(f"{path}/list")
async def list_agents():
    return {"agents": [{"name": agent.display_name, "id": ...} for agent in self.agents]}

There is no middleware, dependency, token comparison, bearer-token parsing, API-key check, or startup fail-closed guard in this launch path.

Security Boundary

This is not a trust-model-only report. PraisonAI's own current security documentation says API servers were hardened so that anonymous requests return 401 and API servers bind to 127.0.0.1 by default after the prior unauthenticated API advisory family.

The codebase also contains hardened sibling implementations:

• praisonai.deploy.api now has AUTH_ENABLED, PRAISONAI_API_TOKEN, generated tokens, and 401 Unauthorized checks (src/praisonai/praisonai/deploy/api.py lines 44-62 and 69-97).
• praisonai.gateway.server.WebSocketGateway validates external bind safety, requires a token for external binds, checks bearer/query/cookie auth, and validates WebSocket auth (src/praisonai/praisonai/gateway/server.py lines 328-424).
• praisonai call hardening is documented as requiring CALL_SERVER_TOKEN or explicit opt-out.

AgentTeam.launch() remains outside those shared controls even though it exposes the same class of network-facing agent invocation surface.

Local-Only Reproduction

Run the local-only PoV script below with current source…

PraisonAI AgentTeam.launch() exposes unauthenticated remote agent invocation endpoints

Summary

PraisonAI's documented Python AgentTeam.launch() / Agents.launch() HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement.

The current implementation registers GET /{path}/list, POST /{path}, and POST /{path}/{agent_id} routes. The POST routes directly call agent.chat(...). Requests with no Authorization header are accepted, and requests with an obviously wrong bearer token are also accepted. The default Python API bind host for Agents.launch() is 0.0.0.0, and official documentation shows host="0.0.0.0" for remote access.

This is a sibling/incomplete-fix variant of PraisonAI's prior unauthenticated API server and call server advisory family. Nearby server surfaces were hardened to require tokens, fail closed, or bind locally by default, but the AgentTeam.launch() FastAPI path still exposes unauthenticated agent execution on current upstream main and the latest release.

This report is scoped to the Python AgentTeam.launch() / Agents.launch() route-registration path. It does not require adjudicating whether the separate praisonai serve agents --api-key CLI path is correctly enforced.

Affected Components

• Package: praisonaiagents
• Current upstream main tested: 2f9677abb2ea68eab864ee8b6a828fd0141612e1
• Latest release tag tested: v4.6.57
• Primary file: src/praisonai-agents/praisonaiagents/agents/agents.py
• Current line references: AgentTeam.launch() begins at line 1923; the group POST route is registered at line 2007; the group handler invokes agent_instance.chat(...) at line 2042; the unauthenticated list route is registered at line 2086; per-agent handlers invoke agent.chat(...) at line 2117.
• Primary class/API: AgentTeam.launch() / exported alias Agents
• Affected routes:
  • GET /{path}/list: lists deployed agents.
  • POST /{path}: sequentially invokes all agents in the team.
  • POST /{path}/{agent_id}: invokes a specific agent.

Current vulnerable sink:

@app.post(path)
async def handle_query(request: Request, query_data: Optional[AgentQuery] = None):
    ...
    response = await loop.run_in_executor(
        None,
        copy_context_to_callable(lambda ci=current_input: agent_instance.chat(ci)),
    )

Per-agent sink:

app.post(agent_path)(create_agent_handler(agent_instance))
...
response = await loop.run_in_executor(
    None,
    copy_context_to_callable(lambda q=query: agent.chat(q)),
)

List endpoint:

@app.get(f"{path}/list")
async def list_agents():
    return {"agents": [{"name": agent.display_name, "id": ...} for agent in self.agents]}

There is no middleware, dependency, token comparison, bearer-token parsing, API-key check, or startup fail-closed guard in this launch path.

Security Boundary

This is not a trust-model-only report. PraisonAI's own current security documentation says API servers were hardened so that anonymous requests return 401 and API servers bind to 127.0.0.1 by default after the prior unauthenticated API advisory family.

The codebase also contains hardened sibling implementations:

• praisonai.deploy.api now has AUTH_ENABLED, PRAISONAI_API_TOKEN, generated tokens, and 401 Unauthorized checks (src/praisonai/praisonai/deploy/api.py lines 44-62 and 69-97).
• praisonai.gateway.server.WebSocketGateway validates external bind safety, requires a token for external binds, checks bearer/query/cookie auth, and validates WebSocket auth (src/praisonai/praisonai/gateway/server.py lines 328-424).
• praisonai call hardening is documented as requiring CALL_SERVER_TOKEN or explicit opt-out.

AgentTeam.launch() remains outside those shared controls even though it exposes the same class of network-facing agent invocation surface.

Local-Only Reproduction

Run the local-only PoV script below with current source…