Critical PraisonAI Vulnerability Exploited Hours After Disclosure

Key Takeaways

• A critical vulnerability, CVE-2026-44338, has been identified in PraisonAI’s legacy API server.
• The flaw, rated as high severity, allows unauthenticated attackers to hijack AI agent operations and exhaust API quotas.
• The vulnerability stems from insecure default configurations that disable authentication and bind to all network interfaces.
• PraisonAI has released version 4.6.34 to patch the issue, and users are urged to update immediately and migrate to the newer ‘serve agents’ command.

The rapid adoption of artificial intelligence frameworks across enterprise operations has introduced new vectors for security vulnerabilities. A significant flaw in a widely used AI platform, PraisonAI, has emerged, exposing organizations to substantial risk from threat actors, with active exploitation reported just hours after its public disclosure.

The vulnerability, designated as CVE-2026-44338, affects PraisonAI’s legacy API server and has already sent ripples through the developer community. Its severity is compounded by the fact that the framework ships with authentication disabled by default, essentially granting unauthorized access to its core functionalities.

This critical design oversight enables any entity on the network to commandeer automated agent operations, execute tasks, and deplete costly API quotas without needing valid credentials.

PraisonAI Vulnerability Exploited

The high-severity flaw originates deep within the legacy Flask API server, specifically within the src/praisonai/api_server.py entrypoint. Security researchers uncovered that the codebase contains hard-coded insecure defaults, explicitly setting AUTH_ENABLED = False and AUTH_TOKEN = None.

Due to the inherent design of the underlying check_auth() function, which defaults to an “open” state when authentication is disabled, all incoming requests are automatically allowed to bypass standard security protocols.

Further exacerbating the risk, when this script is directly initiated, it binds to 0.0.0.0:8080. This configuration exposes vulnerable, unprotected endpoints across all reachable network interfaces instead of confining them to secure, local environments. The framework’s deployment subsystem also mirrors this insecure setup, generating sample configurations that advocate for open host bindings alongside disabled authentication.

Threat actors can effortlessly exploit this vulnerability by targeting two primary endpoints without providing an Authorization header. A simple GET request to the /agents route permits unauthenticated enumeration of configured agent metadata, providing attackers with immediate insight into the system’s operational scope. More critically, sending a POST request to /chat instantaneously triggers the system’s local agents.yaml workflow.

As detailed in GitHub Advisories GHSA-6rmh-7xcm-cpxj, this flaw allows external attackers to repeatedly activate pre-configured automated workflows. While direct prompt injection is not enabled, attackers can easily extract sensitive output data from the system and force the victim’s infrastructure to exhaust expensive external AI model quotas through repeated execution.

PraisonAI maintainers have addressed this critical vulnerability by releasing version 4.6.34. Developers utilizing the pip package are strongly advised to update their environments immediately to prevent ongoing exploitation.

Furthermore, security engineers are urged to transition away from the legacy API server and adopt the newer serve agents command. This modern deployment pathway is secure by default, binding locally to 127.0.0.1 and requiring an --api-key argument for access, effectively neutralizing the threat of unauthenticated intrusion.

What You Should Do

• Immediately update your PraisonAI environment to version 4.6.34 or later to patch CVE-2026-44338.
• Migrate from the legacy API server to the newer serve agents command.
• Ensure that all AI framework deployments bind to local interfaces (e.g., 127.0.0.1) and require API keys or other robust authentication mechanisms.
• Audit existing PraisonAI configurations to verify that authentication is explicitly enabled and not running with default insecure settings.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.