Exposed API Vulnerability in PraisonAI AgentOS Deployment Platform

CVE-2026-40151

What is CVE-2026-40151?

PraisonAI's AgentOS deployment platform is susceptible to an information exposure vulnerability affecting versions prior to 4.5.128. The platform's GET /api/agents endpoint allows unauthenticated users to access sensitive data, including agent names, roles, and the initial 100 characters of the agents' system instructions. This is due to the absence of authentication middleware and API key validation within the FastAPI application, combined with permissive CORS settings set to allow all origins by default. As a result, any user can query this endpoint from any network, potentially leading to unauthorized information retrieval.

References