Scanner Probed PraisonAI Auth Bypass 3 Hours After CVE-2026-44338 Disclosure
Summary
Sysdig says a scanner probed PraisonAI’s unauthenticated legacy API 3 hours 44 minutes after CVE-2026-44338 was disclosed. The flaw can trigger configured workflows; upgrade to 4.6.34 or later and restrict exposure.
Key points
- CVE-2026-44338 affects PraisonAI’s legacy Flask API server, which shipped with authentication disabled by default.
- Unauthenticated GET /agents and POST /chat endpoints were exposed in versions 2.5.6 through 4.6.33; version 4.6.34 fixes the issue.
- Sysdig TRT observed a scanner probe the vulnerable endpoint 3 hours, 44 minutes, and 39 seconds after the advisory was published.
- The observed GET /agents request lacked an Authorization header and returned 200 OK, confirming the authentication bypass; the scanner did not send POST /chat.
- An unauthenticated POST /chat can trigger the configured workflow, with potential effects depending on its tools and setup, such as model API usage or file and network actions.
- Sysdig recommends upgrading, migrating from the legacy API server, restricting network exposure, and auditing credentials referenced in agents.yaml.
Article Details
- Attack Vectors
- A scanner sent an unauthenticated GET request to PraisonAI's internet-exposed /agents endpoint, which returned agent metadata and confirmed the authentication bypass.
- The vulnerable POST /chat endpoint can trigger the configured PraisonAI workflow without authentication; the observed scanner did not send this request.
- Defensive Notes
- Upgrade to PraisonAI 4.6.34 or later and migrate away from the legacy api_server.py entrypoint.
- Do not expose the legacy API server to the internet; bind it to loopback or a private network and use authentication where supported.
- Monitor at the perimeter for unauthenticated GET /agents or POST /chat requests, especially those using User-Agent CVE-Detector/1.0, and check for requests to Python-package fingerprint paths.
- Audit deployments using the sample API deployment YAML, review model-provider billing, and rotate credentials referenced in agents.yaml.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 146[.]190[.]133[.]49 | Source IP observed probing PraisonAI endpoints, including the vulnerable /agents endpoint. |
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe scanner sent an unauthenticated GET request to the exposed PraisonAI /agents endpoint; the 200 OK response confirmed the authentication bypass.T1595 · Active ScanningThe scanner conducted generic reconnaissance and probed internet-exposed systems for PraisonAI-specific paths and endpoints.