cve-2026-44338
HIGH vulncheck_kev
Description
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
Timeline
- Published
- 2026-05-12 00:00 UTC
- Last Modified
- 2026-05-12
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cvss": 0.0,
"datePublished": "2026-05-12T00:00:00Z",
"dateUpdated": "2026-05-12T00:00:00Z",
"description": "PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.",
"dueDate": "",
"id": "CVE-2026-44338",
"kev_catalogs": [
"vulncheck"
],
"knownRansomwareCampaignUse": "Unknown",
"product": "praisonai",
"requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
"severity": "HIGH",
"source": "vulncheck_kev",
"title": "praison praisonai Missing Authentication for Critical Functionality",
"vendor": "praison"
}
Enrichment data
Aggregated bundle (all enrichments)