PraisonAI Authentication Bypass Probed Within Four Hours of Disclosure
Summary
Sysdig says a scanner probed internet-exposed PraisonAI instances within 3 hours and 44 minutes of CVE-2026-44338 disclosure. The flaw affects versions 2.5.6–4.6.33 and is fixed in 4.6.34.
Key points
- CVE-2026-44338 affects PraisonAI versions 2.5.6 through 4.6.33, which shipped with authentication disabled by default on a legacy Flask API server.
- Without a token, callers able to reach the server can access /agents and trigger the configured agents.yaml workflow through /chat.
- Sysdig observed a scanner probing the vulnerable endpoint within 3 hours and 44 minutes of public disclosure.
- The scanner targeted /agents but did not request /chat; Sysdig assessed the activity as reconnaissance and validation, not interactive exploitation.
- Sysdig says the bypass does not itself provide arbitrary code execution; potential impact depends on what the configured workflow is permitted to do.
- PraisonAI fixed the vulnerability in version 4.6.34; organizations are advised to update.
Article Details
- Vulnerability Types
- Authentication bypass
- Affected Versions
- PraisonAI 2.5.6 to 4.6.33
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available