External risk intelligence

PraisonAI AgentOS Unauthenticated Chat Route Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-57116

PraisonAI is designed as an AgentOS FastAPI deployment. FastAPI services are commonly deployed as web apps or API endpoints. Since the chat route is exposed and unauthenticated by default, this creates an externally reachable interface where users or systems interact with deployed agents, making public or internal network exposure a standard deployment pattern for this product.

Information Disclosure

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects PraisonAI's AgentOS FastAPI deployment, allowing unauthenticated access to agent functionalities. If AgentOS is configured to wrap agents with private data, API integrations, or cost-associated models, an external party could potentially interact with these sensitive operations. This could lead to unauthorized actions or access to information handled by the agents.

Unauthenticated access to AI agent chat functions.
Critical as it exposes agent capabilities and data.
Confirm relevance and assess exposure to sensitive operations.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending unauthenticated requests to the AgentOS FastAPI deployment surface. This allows them to interact directly with deployed agents, potentially leading to unauthorized access and control over sensitive agent capabilities.

Unauthenticated network access required.
Chat route triggers agent interaction.
Risk of unauthorized agent actions.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated user could directly interact with and control agents within PraisonAI's AgentOS. When AgentOS is configured with tools, private context, memory, or API integrations, an unauthenticated client can cause these agents to perform actions. This could lead to unauthorized use of integrated services or manipulation of agent behavior when the system is deployed in such configurations.

Agent capabilities and integrated services.
Directly calling agent functions without authentication.
Unauthorized use of agent tools and services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in PraisonAI's AgentOS FastAPI deployment impacts deployments that wrap agents with tools, private context, memory, API integrations, or cost-bearing model calls. Infrastructure and platform teams are likely responsible for identifying and securing these deployments. The first practical step is to locate all instances of the affected AgentOS, determine their network reachability and business criticality, and then engage the accountable owner to plan remediation based on the assessed risk.

Application and Platform Owners
Verify AgentOS network exposure.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework used to build and orchestrate multi-agent systems. It features an AgentOS component, built on FastAPI, which manages the lifecycle and interaction of these agents. Developers use it to connect agents with specialized tools, memory, private context, and external API integrations, allowing them to automate complex workflows.

What does CVE-2026-57116 mean regarding software security?

This vulnerability is classified primarily as a Missing Authentication for Critical Function (CWE-306) and a Missing Authorization (CWE-862). Essentially, the software's chat interface fails to verify the identity of the user before executing commands. This allows any network client to bypass security checks and trigger agent actions that should be restricted to authenticated users.

How does an attacker trigger this vulnerability?

An attacker triggers the vulnerability by sending a request directly to the AgentOS chat route without providing valid credentials. The system will process the message even if the request lacks a bearer token or contains an invalid one. Simply browsing to the interface or sending a crafted API call is sufficient; interactions that do not target the chat endpoint do not trigger this specific issue.

Is my PraisonAI deployment at risk?

According to Halo Surface Signal, this software is typically deployed as a web application or API endpoint. If your instance is reachable over the internet or an internal network, it is at risk because the chat route lacks necessary authentication by default. You should check if your deployment exposes this FastAPI service to unauthorized users or systems.

What should I do to secure my system?

The primary response is to update your software to version 4.6.59 or later, which contains the fix for this issue. Before applying updates, identify all instances of AgentOS in your environment, determine their network accessibility, and assess the sensitivity of the tools or data those agents can access.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-892r…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.