CVE-2026-57116— PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI 是一个多智能体团队系统。在版本 4.2.1 至 4.6.59 之前的所有版本中，PraisonAI 的 AgentOS FastAPI 部署接口在当前的主分支（main）以及针对 GHSA-pm96-6xpr-978x / CVE-2026-40151 发布补丁后的版本中，仍然未实施身份验证。其聊天路由会直接调用 方法，导致未经身份验证的请求和携带错误 Bearer 令牌的请求均能执行已部署的智能体。该漏洞的影响范围远不止被动的元数据泄露：在任何将工具、私有上下文、记忆机制、API 集成或需付费
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.2.1, < 4.6.59 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57116
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.2.1, < 4.6.59 | - |
|
II. Public POCs for CVE-2026-57116
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57116
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-57116 (1)
Same Patch Batch · MervinPraison · 2026-10-23 · 16 CVEs total
| CVE-2026-56832 | 8.8 HIGH | PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals |
| CVE-2026-56840 | 8.8 HIGH | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-pa |
| CVE-2026-57117 | 8.8 HIGH | PraisonAI: Compute-bridged file tools allow shell command injection |
| CVE-2026-57144 | 8.8 HIGH | PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is |
| CVE-2026-56837 | 8.6 HIGH | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing |
| CVE-2026-56835 | 8.3 HIGH | PraisonAI Slack app_mention bypasses configured user/channel authorization |
| CVE-2026-56836 | 8.2 HIGH | PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard |
| CVE-2026-57113 | 8.1 HIGH | PraisonAI GitHub template cache path traversal allows outside-cache file write and directo |
| CVE-2026-57121 | 8.1 HIGH | PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' co |
| CVE-2026-56838 | 7.8 HIGH | PraisonAI recipe.run_stream skips dangerous-tool policy enforcement |
| CVE-2026-57142 | 7.8 HIGH | PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous |
| CVE-2026-56833 | 7.5 HIGH | PraisonAI Dynamic Context history and terminal tools read files outside configured storage |
| CVE-2026-56834 | 7.5 HIGH | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storag |
| CVE-2026-57146 | 7.5 HIGH | PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated b |
| CVE-2026-57114 | 7.2 HIGH | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding |
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow
Same vendor: MervinPraison
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow
Same weakness: CWE-200
-
CVE-2026-55826
Customer Order Data Exposed via Unauthenticated gtm_server_s -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-115449
Libslirp: libslirp: icmp echo reply length desynchronization -
CVE-2026-114657
Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via -
CVE-2026-114574
massCodeIO massCode Local HTTP Service index.ts information
V. Comments for CVE-2026-57116
No comments yet