{"cvss":0.0,"datePublished":"2026-05-12T00:00:00Z","dateUpdated":"2026-05-12T00:00:00Z","description":"PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.","dueDate":"","id":"CVE-2026-44338","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"praisonai","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"praison praisonai Missing Authentication for Critical Functionality","vendor":"praison"}