PraisionAI 1.6.59 Patches CVSS 9.8 Auth Bypass Exposing Private Context and Agent Workflows

A critical security flaw in PraisonAI’s multi-agent system allows remote attackers to bypass authentication entirely. The vulnerability, tracked as CVE-2026-57118, affects versions of the praisonaiagents package prior to 1.6.59. The National Vulnerability Database rates the issue with a CVSS score of 9.8, classifying it as critical. This means any server exposing these endpoints to the internet is vulnerable to immediate exploitation by unauthenticated clients.

What exactly is the technical flaw?

The core issue lies in how PraisonAI handles API requests for its agent teams. According to the NVD record, the AgentTeam.launch function and the Agents alias register several endpoints without implementing access-control checks. Specifically, the GET /{path}/list, POST /{path}, and POST /{path}/{agent_id} endpoints are exposed. These endpoints allow users to list available agents, interact with them, and trigger specific actions. Because there is no verification of user identity or permissions, anyone who can reach the server can use these functions.

This lack of authentication maps to CWE-306, which covers missing authentication for critical functions, and CWE-862, which relates to missing authorization. The flaw essentially leaves the door open for any remote client to interact with the system as if they had full privileges. This is particularly dangerous in environments where the PraisonAI service is hosted on public-facing infrastructure or within cloud environments that are accessible via the internet.

What can an attacker do with this?

An attacker exploiting CVE-2026-57118 can perform several harmful actions without needing valid credentials. First, they can enumerate the agents present in the system, gaining insight into the structure and capabilities of the deployment. Second, they can consume model resources, potentially leading to denial-of-service conditions or increased costs for the organization hosting the service. Third, and most critically, they can access connected private context. This means sensitive data that agents are configured to use or retrieve could be exposed to the attacker.

Furthermore, the vulnerability allows attackers to trigger agent tools and workflow side effects. This means an attacker could initiate automated processes, send messages, or perform actions that the agents are programmed to execute. This could lead to data exfiltration, system instability, or other unintended consequences depending on the agents’ permissions and the tools they have access to. The NVD description explicitly states that unauthenticated clients can trigger these side effects, highlighting the operational risk.

Which versions are affected?

The vulnerability affects PraisonAI systems running versions prior to the fix. Specifically, the NVD record lists MervinPraison PraisonAI versions less than 4.6.59 as affected. It also lists MervinPraison praisonaiagents versions less than 1.6.59. Organizations using any version below these thresholds are vulnerable to CVE-2026-57118. Users should check their current installation versions immediately to determine if they are exposed. The fix is available in praisonaiagents version 1.6.59, which introduces the necessary access-control checks to prevent unauthenticated access.

What should organizations do now?

Organizations using PraisonAI should prioritize updating to the patched version. The vendor has released praisonaiagents 1.6.59, which addresses the vulnerability. Users should verify their current version and upgrade as soon as possible. In the meantime, if updating is not immediately feasible, organizations should restrict network access to the PraisonAI endpoints. Limiting exposure to trusted internal networks can mitigate the risk of remote exploitation. Monitoring logs for unusual activity, such as unexpected agent enumerations or resource consumption, is also advisable.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: PraisonAI

• Update praisonaiagents to version 1.6.59 or later to apply the vendor’s patch.
• Restrict network access to PraisonAI endpoints to trusted internal IPs only.
• Monitor server logs for unauthenticated requests to agent listing or interaction endpoints.
• Audit agent permissions and connected data sources to limit potential damage from exposure.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is CVE-2026-57118 being actively exploited in the wild?

The source material does not state whether active exploitation is occurring; it only describes the vulnerability and its fix.

What is the CVSS score for this vulnerability?

The CVSS score for CVE-2026-57118 is 9.8, which is rated as Critical.

Which specific endpoints are vulnerable?

The GET /{path}/list, POST /{path}, and POST /{path}/{agent_id} endpoints are vulnerable to unauthenticated access.