CVE-2026-44338 PraisonAI Unauthenticated API Bypass — Active Exploitation Within 4 Hours of Disclosure (Sysdig TRT) — Threadlinqs Intelligence
As of 2026-05-30, CVE-2026-44338 PraisonAI Unauthenticated API Bypass — Active Exploitation Within 4 Hours of Disclosure (Sysdig TRT) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-0502 · Severity: HIGH · CVSS: 7.3 · Status: MONITORING · Category: VULNERABILITY
PraisonAI, an open-source multi-agent orchestration framework (~7,100 GitHub stars), shipped its legacy api_server.py entrypoint with authentication disabled by default (AUTH_ENABLED = False,
## Overview
CVE-2026-44338 is a critical-impact authentication-bypass vulnerability in PraisonAI, an open-source multi-agent LLM orchestration framework maintained by MervinPraison with roughly 7,100 GitHub stars. The legacy Flask-based API server entrypoint (`src/praisonai/api_server.py`) was shipped with module-level flags `AUTH_ENABLED = False` and `AUTH_TOKEN = None`, and the helper `check_auth()` was implemented to return `True` whenever authentication is disabled. The two protected routes — `GET /agents` and `POST /chat` — therefore fail open by design in every default deployment, allowing any unauthenticated caller on the network to enumerate agent configuration and trigger configured workflows.
GitHub advisory GHSA-6rmh-7xcm-cpxj was published on 2026-05-11 13:56:16 UTC. The Sysdig Threat Research Team's early-warning sensor network observed initial generic disclosure-paths recon (`/.env`, `/admin`, `/users/sign_in`, `/eval`, `/calculate`, `/Gemfile.lock`) from a single DigitalOcean IP (146.190.133.49 — AS14061, DigitalOcean LLC, US) at 17:32:50 UTC, followed eight minutes later by a PraisonAI-specific second pass enumerating `/praisonai/version.txt`, `/docs`, `/openapi.json`, `/api/agents/config`, `/api/agents`, `/api/v1/agents`, `/api/tasks`, `/api/tools`, `/agents`, and a series of MCP-server discovery paths (`/api/mcp/config`, `/api/mcp/servers`, `/api/mcp/list`, `/api/mcp/status`, `/mcp/config`). At 17:40:53 UTC the scanner issued a `GET /agents` request carrying the User-Agent `CVE-Detector/1.0` — the canonical proof-of-vulnerability probe described by the advisory. A vulnerable host responds 200 OK with a JSON body of the form `{"agent_file":"agents.yaml","agents":[...]}`, disclosing both the agent-definition filename and full agent list, including any tools wired into the workflow.
The advisory-to-first-targeted-exploitation latency of 3h 44m 39s places this incident alongside three other rapid-exploitation events Sysdig has documented in 2026: Marimo (RCE — under 10 hours), LMDeploy (CVE-2026-33626 — exploited in 12 hours), and Langflow (CVE-2026-33017 — compromised in 20 hours). The TRT positions CVE-2026-44338 as another data point in a Zero-Day-Clock trend driven by AI-assisted patch reverse-engineering, where opportunistic actors can produce functional exploits within minutes of public disclosure and weaponize them against internet-exposed instances before defenders patch.
## Root Cause
The vulnerable file is `src/praisonai/api_server.py`, a legacy Flask blueprint that predates the project's newer FastAPI server (which binds to 127.0.0.1 by default and uses bearer-token authentication). The Flask server contains module-level constants `AUTH_ENABLED = False` and `AUTH_TOKEN = None`, and the `check_auth()` decorator implementation returns `True` (i.e. authorized) whenever `AUTH_ENABLED` is falsy, regardless of any Authorization header. Operators who launch PraisonAI's API via the documented `python -m praisonai.api_server` workflow therefore expose `GET /agents` and `POST /chat` to any caller able to reach the listening interface, which defaults to all interfaces (`0.0.0.0`).
The issue maps to three CWEs: CWE-306 (Missing Authentication for Critical Function), CWE-668 (Exposure of Resource to Wrong Sphere), and CWE-1188 (Initialization of a Resource with an Insecure Default). NVD recorded CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 (HIGH); real-world impact is materially higher in deployments where PraisonAI agents are configured with high-privilege tools (shell, code_interpreter, file I/O, HTTP requestor).
## Exploit Chain
1. **Reconnaissance (TA0043).** The attacker performs broad scanning of internet-facing hosts using a generic disclosure-path wordlist (`/.env`, `/admin`, `/users/sign_in`, etc.). The first pass against any individual host is technology-agnostic — a baseline fingerprint sweep, not yet PraisonAI-specific.
2. **Targeted enumeration (TA0043 — T1595.002).** Where the first pass
Weaknesses (CWE)
CWE-306, CWE-668, CWE-1188
Target sectors: technology, ai-development, research, saas, fintech
Target regions: Global
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-44338, T1595, T1595.001, T1595.002, T1595.003, T1592.002, T1583.003, T1588.005, T1190, T1133, T1059.006