Authentication Bypass Vulnerability in PraisonAI by Mervin Praison

CVE-2026-57140

What is CVE-2026-57140?

PraisonAI, a multi-agent systems platform, contains a vulnerability in its AgentOS component where the default IP address (0.0.0.0) is utilized. This flaw, affecting versions 1.6.0 through 1.7.2, enables unauthorized remote access to certain API endpoints, specifically GET /api/agents and POST /api/chat. As a result, an attacker can potentially access sensitive information including agent names, roles, and operational instructions. Furthermore, the vulnerability allows for the invocation of agents, granting exposure to workflows, external APIs, and even sensitive credentials. The vendor has provided remediation in version 1.7.2 to address this issue.

References