## Overview

CVE-2026-44338 is a critical-impact authentication-bypass vulnerability in PraisonAI, an open-source multi-agent LLM orchestration framework maintained by MervinPraison with roughly 7,100 GitHub stars. The legacy Flask-based API server entrypoint (`src/praisonai/api_server.py`) was shipped with module-level flags `AUTH_ENABLED = False` and `AUTH_TOKEN = None`, and the helper `check_auth()` was implemented to return `True` whenever authentication is disabled. The two protected routes — `GET /agents` and `POST /chat` — therefore fail open by design in every default deployment, allowing any unauthenticated caller on the network to enumerate agent configuration and trigger configured workflows.

GitHub advisory GHSA-6rmh-7xcm-cpxj was published on 2026-05-11 13:56:16 UTC. The Sysdig Threat Research Team's early-warning sensor network observed initial generic disclosure-paths recon (`/.env`, `/admin`, `/users/sign_in`, `/eval`, `/calculate`, `/Gemfile.lock`) from a single DigitalOcean IP (146.190.133.49 — AS14061, DigitalOcean LLC, US) at 17:32:50 UTC, followed eight minutes later by a PraisonAI-specific second pass enumerating `/praisonai/version.txt`, `/docs`, `/openapi.json`, `/api/agents/config`, `/api/agents`, `/api/v1/agents`, `/api/tasks`, `/api/tools`, `/agents`, and a series of MCP-server discovery paths (`/api/mcp/config`, `/api/mcp/servers`, `/api/mcp/list`, `/api/mcp/status`, `/mcp/config`). At 17:40:53 UTC the scanner issued a `GET /agents` request carrying the User-Agent `CVE-Detector/1.0` — the canonical proof-of-vulnerability probe described by the advisory. A vulnerable host responds 200 OK with a JSON body of the form `{"agent_file":"agents.yaml","agents":[...]}`, disclosing both the agent-definition filename and full agent list, including any tools wired into the workflow.

The advisory-to-first-targeted-exploitation latency of 3h 44m 39s places this incident alongside three other rapid-exploitation events Sysdig has documented in 2026: Marimo (RCE — under 10 hours), LMDeploy (CVE-2026-33626 — exploited in 12 hours), and Langflow (CVE-2026-33017 — compromised in 20 hours). The TRT positions CVE-2026-44338 as another data point in a Zero-Day-Clock trend driven by AI-assisted patch reverse-engineering, where opportunistic actors can produce functional exploits within minutes of public disclosure and weaponize them against internet-exposed instances before defenders patch.

## Root Cause

The vulnerable file is `src/praisonai/api_server.py`, a legacy Flask blueprint that predates the project's newer FastAPI server (which binds to 127.0.0.1 by default and uses bearer-token authentication). The Flask server contains module-level constants `AUTH_ENABLED = False` and `AUTH_TOKEN = None`, and the `check_auth()` decorator implementation returns `True` (i.e. authorized) whenever `AUTH_ENABLED` is falsy, regardless of any Authorization header. Operators who launch PraisonAI's API via the documented `python -m praisonai.api_server` workflow therefore expose `GET /agents` and `POST /chat` to any caller able to reach the listening interface, which defaults to all interfaces (`0.0.0.0`).

The issue maps to three CWEs: CWE-306 (Missing Authentication for Critical Function), CWE-668 (Exposure of Resource to Wrong Sphere), and CWE-1188 (Initialization of a Resource with an Insecure Default). NVD recorded CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 (HIGH); real-world impact is materially higher in deployments where PraisonAI agents are configured with high-privilege tools (shell, code_interpreter, file I/O, HTTP requestor).

## Exploit Chain

1. **Reconnaissance (TA0043).** The attacker performs broad scanning of internet-facing hosts using a generic disclosure-path wordlist (`/.env`, `/admin`, `/users/sign_in`, etc.). The first pass against any individual host is technology-agnostic — a baseline fingerprint sweep, not yet PraisonAI-specific. 2. **Targeted enumeration (TA0043 — T1595.002).** Where the first pass returns FastAPI-style responses on `/docs` or `/openapi.json`, the scanner pivots to a PraisonAI-tailored wordlist hitting `/praisonai/version.txt`, `/api/agents/config`, `/api/agents`, `/api/v1/agents`, `/api/tasks`, `/api/tools`, `/agents`, and MCP-server discovery endpoints. This pivot occurred ~8 minutes after the initial pass in the observed Sysdig telemetry. 3. **Vulnerability confirmation (TA0001 — T1190).** A `GET /agents` request with User-Agent `CVE-Detector/1.0` produces a 200 OK body disclosing `agent_file` and the agent list. Receipt of this response confirms an unpatched 2.5.6 ≤ version ≤ 4.6.33 instance. 4. **Workflow execution (TA0002).** The attacker issues `POST /chat` with a JSON body `{"message": "..."}` to trigger the configured agent workflow. The behavior of this request is governed entirely by the operator's `agents.yaml`: workflows wired to `code_interpreter` enable arbitrary Python execution; workflows wired to `shell` enable command execution; workflows wired to `http_request` or similar tools enable SSRF/egress; workflows with no destructive tools still burn LLM tokens. 5. **Resource hijacking / collection (TA0040 — T1496 / TA0009 — T1213).** Even read-only deployments leak sensitive workflow design via `GET /agents` (system prompts, tool wiring) and incur direct cost via looped `POST /chat` requests that consume the operator's model-provider quota.

## Attacker Infrastructure

The single observed source IP at the time of Sysdig's reporting is 146.190.133.49, hosted on AS14061 (DigitalOcean LLC, US). The scanner's identifying User-Agent string `CVE-Detector/1.0` is operationally useful as a detection signature; Sysdig notes the string is unusual for any benign tooling and treats it as a strong opportunistic-scanner indicator. Two passes were observed per target, each containing ~70 requests over ~50 seconds. No persistence, beaconing, or post-exploitation tooling has been attributed publicly at the time of the disclosure window.

## Affected and Fixed Versions

Vulnerable: PraisonAI 2.5.6 through 4.6.33 inclusive (PyPI: `praisonai`). At the moment of GHSA publication, the current PyPI release (4.6.33) was the most recent vulnerable build. The patched release 4.6.34 either enables authentication by default, removes the legacy `api_server.py` from the documented launch path, or binds the legacy server to loopback — operators are strongly advised to upgrade rather than configure-out the issue. The newer FastAPI-based server in the same project is not affected by this CVE.

## Remediation

- **Immediate:** Upgrade to PraisonAI ≥ 4.6.34. If upgrade is blocked, stop the legacy `api_server.py` process or bind it to 127.0.0.1 / a trusted private network. Block inbound traffic to ports running PraisonAI from the public internet. - **Detection:** Alert on inbound `GET /agents` or `POST /chat` requests against any PraisonAI-hosting interface that lack an `Authorization` header. Alert on the literal string `CVE-Detector/1.0` in HTTP user-agent fields. Search HTTP logs back to 2026-05-11 13:56 UTC for requests to `/praisonai/version.txt`, `/api/agents/config`, `/api/mcp/config`. - **Triage:** Audit model-provider (OpenAI, Anthropic, Google) billing dashboards from 2026-05-11 onward for unexplained usage spikes. Rotate any API keys, credentials, or tokens referenced from `agents.yaml`. Review agent definitions for tools (shell, code_interpreter, HTTP) that could have been weaponized, and assume those tools were invoked if the host was internet-exposed during the window. - **Long-term:** Treat agent-framework launch entrypoints as production services subject to standard hardening (token auth, TLS, network segmentation, rate limiting, request logging). Bake AI-framework CVE feeds into routine vulnerability-management cadence given the demonstrated <24h exploitation pattern.