CVE-2026-57116
PraisonAI is a multi-agent teams system
- Risk score
- 72/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- PraisonAI's AgentOS has an unauthenticated deployment surface in versions 4.2.1 to 4.6.59, allowing an attacker to execute agents and access private context, memory, and API integrations. This is a critical vulnerability with a CVSS score of 9.8.
- Affected
- {'products': ['PraisonAI'], 'packages': [], 'versions': ['4.2.1', '4.3', '4.4', '4.5', '4.6.0', '4.6.1', '4.6.2', '4.6.3', '4.6.4', '4.6.5', '4.6.6', '4.6.7', '4.6.8', '4.6.9', '4.6.10', '4.6.11', '4.6.12', '4.6.13', '4.6.14', '4.6.15', '4.6.16', '4.6.17', '4.6.18', '4.6.19', '4.6.20', '4.6.21', '4.6.22', '4.6.23', '4…
- Fix
- Upgrade to version 4.6.59 or later
- Exploitation
- No known exploitation
Not confirmed. 4.3, 4.4, 4.5, 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4 isn't in the advisory. Check the vendor's advisory before acting on this.
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
Last activity 23 Oct 2026. Patch Forecast updates every hour.