External risk intelligence

PraisonAI Agent Team Launch Unauthenticated Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-57118

The vulnerability exists in a multi-agent system framework that exposes HTTP endpoints for agent management and chat operations. As these components are designed to be launched as servers to provide agent services, they are commonly deployed as web applications or APIs, making them likely to be reachable from the internet in typical service-oriented or developer-facing deployments.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the PraisonAI multi-agent systems, specifically affecting agent team launching and registration functions. Without proper access controls, unauthenticated users can enumerate agents, consume resources, access private context, and trigger unintended actions. This could allow unauthorized parties to interact with or misuse the agent system's capabilities.

Unauthenticated access to agent capabilities.
Critical risk if agent system is externally facing.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable PraisonAI system over the network without needing any credentials. By sending specific HTTP requests to the agent management endpoints, an unauthenticated user can enumerate existing agents, interact with them, access private data, and cause unintended actions. This could lead to unauthorized use of model resources and execution of agent tool side effects.

No authentication required.
Triggered by unauthenticated network requests.
Risks include data access and unauthorized actions.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated clients could interact with a remotely exposed PraisonAI server to enumerate agents, consume model resources, and access connected private context. This could also trigger agent tools or workflow side effects.

Agent enumeration and resource consumption.
Unauthenticated network access to services.
Unauthorized execution of agent actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI system's multi-agent framework is susceptible to unauthenticated access, potentially allowing unauthorized users to enumerate agents, consume resources, access private context, and trigger agent actions. The first step for technical leaders and security teams is to locate all instances of the affected PraisonAI technology, confirm exposure and business criticality, identify the accountable owner, and then plan remediation based on the assessed risk.

Ownership likely rests with platform or application teams.
Verify agent system reachability and business impact.
Coordinate vendor updates and planned maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI and how does it function?

PraisonAI is a framework designed for creating and managing multi-agent systems. It allows users to orchestrate teams of AI agents that can perform tasks, use tools, and maintain context. It provides capabilities to launch agent teams and register them via specific server endpoints, enabling developers to build and deploy conversational or task-oriented AI applications that act as a cohesive service.

What is the security weakness in CVE-2026-57118?

The vulnerability involves missing authentication for critical functions, categorized as CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization). Essentially, the software fails to verify who is making a request before allowing access to its agent management features. This allows unauthenticated users to interact with the system as if they were authorized administrators or users.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending unauthenticated HTTP requests, such as GET or POST commands, directly to the agent management endpoints. These endpoints normally require authorization to list agents or initiate chats. Crucially, the vulnerability does not require the attacker to have pre-existing credentials, local system access, or specific user interaction; simply reaching the network-accessible server is sufficient to exploit the flaw.

Is my PraisonAI deployment at risk?

You should be concerned if your instance is network-accessible. According to Halo Surface Signal, this software is typically deployed as a web application or API service. If your server is reachable from the internet or exposed across wide network segments, it is likely to be reachable by unauthorized parties who could then enumerate your agents, access private data, or trigger unintended workflow actions.

What are the first steps to secure my environment?

Start by identifying all deployed instances of PraisonAI within your organization to assess their accessibility and business importance. Ensure that you transition to version 1.6.59 or later, which contains the necessary authentication fixes. Until you can apply the update, consider restricting network access to these endpoints using firewalls or VPNs to ensure only trusted users can communicate with the agent services.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.