# CVE-2026-44338 PraisonAI Unauthenticated API Bypass — Active Exploitation Within 4 Hours of Disclosure (Sysdig TRT)

> PraisonAI, an open-source multi-agent orchestration framework (~7,100 GitHub stars), shipped its legacy api_server.py entrypoint with authentication disabled by default (AUTH_ENABLED = False, AUTH_TOKEN = None), exposing GET /agents and POST /chat to any unauthenticated caller across versions 2.5.6 through 4.6.33. GitHub advisory GHSA-6rmh-7xcm-cpxj (CVE-2026-44338, CVSS 7.3) was published on 2026-05-11 at 13:56:16 UTC; Sysdig Threat Research Team observed the first targeted request from 146.190.133.49 (AS14061 DigitalOcean) identifying as CVE-Detector/1.0 against the documented vulnerable path at 17:40:53 UTC the same day — an advisory-to-exploitation latency of 3 hours, 44 minutes, 39 seconds. Sysdig frames this as part of an accelerating pattern of rapid post-disclosure exploitation alongside CVE-2026-33626 (LMDeploy) and CVE-2026-33017 (Langflow).

- **Published:** 2026-05-12T12:00:00Z
- **Last reviewed:** 2026-05-12T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0502
- **ID:** TL-2026-0502
- **Severity:** HIGH (CVSS 7.3)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-44338, CVE-2026-33017, CVE-2026-33626

## Description

## Overview

CVE-2026-44338 is a critical-impact authentication-bypass vulnerability in PraisonAI, an open-source multi-agent LLM orchestration framework maintained by MervinPraison with roughly 7,100 GitHub stars. The legacy Flask-based API server entrypoint (`src/praisonai/api_server.py`) was shipped with module-level flags `AUTH_ENABLED = False` and `AUTH_TOKEN = None`, and the helper `check_auth()` was implemented to return `True` whenever authentication is disabled. The two protected routes — `GET /agents` and `POST /chat` — therefore fail open by design in every default deployment, allowing any unauthenticated caller on the network to enumerate agent configuration and trigger configured workflows.

GitHub advisory GHSA-6rmh-7xcm-cpxj was published on 2026-05-11 13:56:16 UTC. The Sysdig Threat Research Team's early-warning sensor network observed initial generic disclosure-paths recon (`/.env`, `/admin`, `/users/sign_in`, `/eval`, `/calculate`, `/Gemfile.lock`) from a single DigitalOcean IP (146.190.133.49 — AS14061, DigitalOcean LLC, US) at 17:32:50 UTC, followed eight minutes later by a PraisonAI-specific second pass enumerating `/praisonai/version.txt`, `/docs`, `/openapi.json`, `/api/agents/config`, `/api/agents`, `/api/v1/agents`, `/api/tasks`, `/api/tools`, `/agents`, and a series of MCP-server discovery paths (`/api/mcp/config`, `/api/mcp/servers`, `/api/mcp/list`, `/api/mcp/status`, `/mcp/config`). At 17:40:53 UTC the scanner issued a `GET /agents` request carrying the User-Agent `CVE-Detector/1.0` — the canonical proof-of-vulnerability probe described by the advisory. A vulnerable host responds 200 OK with a JSON body of the form `{"agent_file":"agents.yaml","agents":[...]}`, disclosing both the agent-definition filename and full agent list, including any tools wired into the workflow.

The advisory-to-first-targeted-exploitation latency of 3h 44m 39s places this incident alongside three other rapid-exploitation events Sysdig has documented in 2026: Marimo (RCE — under 10 hours), LMDeploy (CVE-2026-33626 — exploited in 12 hours), and Langflow (CVE-2026-33017 — compromised in 20 hours). The TRT positions CVE-2026-44338 as another data point in a Zero-Day-Clock trend driven by AI-assisted patch reverse-engineering, where opportunistic actors can produce functional exploits within minutes of public disclosure and weaponize them against internet-exposed instances before defenders patch.

## Root Cause

The vulnerable file is `src/praisonai/api_server.py`, a legacy Flask blueprint that predates the project's newer FastAPI server (which binds to 127.0.0.1 by default and uses bearer-token authentication). The Flask server contains module-level constants `AUTH_ENABLED = False` and `AUTH_TOKEN = None`, and the `check_auth()` decorator implementation returns `True` (i.e. authorized) whenever `AUTH_ENABLED` is falsy, regardless of any Authorization header. Operators who launch PraisonAI's API via the documented `python -m praisonai.api_server` workflow therefore expose `GET /agents` and `POST /chat` to any caller able to reach the listening interface, which defaults to all interfaces (`0.0.0.0`).

The issue maps to three CWEs: CWE-306 (Missing Authentication for Critical Function), CWE-668 (Exposure of Resource to Wrong Sphere), and CWE-1188 (Initialization of a Resource with an Insecure Default). NVD recorded CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 (HIGH); real-world impact is materially higher in deployments where PraisonAI agents are configured with high-privilege tools (shell, code_interpreter, file I/O, HTTP requestor).

## Exploit Chain

1. **Reconnaissance (TA0043).** The attacker performs broad scanning of internet-facing hosts using a generic disclosure-path wordlist (`/.env`, `/admin`, `/users/sign_in`, etc.). The first pass against any individual host is technology-agnostic — a baseline fingerprint sweep, not yet PraisonAI-specific.
2. **Targeted enumeration (TA0043 — T1595.002).** Where the first pass returns FastAPI-style responses on `/docs` or `/openapi.json`, the scanner pivots to a PraisonAI-tailored wordlist hitting `/praisonai/version.txt`, `/api/agents/config`, `/api/agents`, `/api/v1/agents`, `/api/tasks`, `/api/tools`, `/agents`, and MCP-server discovery endpoints. This pivot occurred ~8 minutes after the initial pass in the observed Sysdig telemetry.
3. **Vulnerability confirmation (TA0001 — T1190).** A `GET /agents` request with User-Agent `CVE-Detector/1.0` produces a 200 OK body disclosing `agent_file` and the agent list. Receipt of this response confirms an unpatched 2.5.6 ≤ version ≤ 4.6.33 instance.
4. **Workflow execution (TA0002).** The attacker issues `POST /chat` with a JSON body `{"message": "..."}` to trigger the configured agent workflow. The behavior of this request is governed entirely by the operator's `agents.yaml`: workflows wired to `code_interpreter` enable arbitrary Python execution; workflows wired to `shell` enable command execution; workflows wired to `http_request` or similar tools enable SSRF/egress; workflows with no destructive tools still burn LLM tokens.
5. **Resource hijacking / collection (TA0040 — T1496 / TA0009 — T1213).** Even read-only deployments leak sensitive workflow design via `GET /agents` (system prompts, tool wiring) and incur direct cost via looped `POST /chat` requests that consume the operator's model-provider quota.

## Attacker Infrastructure

The single observed source IP at the time of Sysdig's reporting is 146.190.133.49, hosted on AS14061 (DigitalOcean LLC, US). The scanner's identifying User-Agent string `CVE-Detector/1.0` is operationally useful as a detection signature; Sysdig notes the string is unusual for any benign tooling and treats it as a strong opportunistic-scanner indicator. Two passes were observed per target, each containing ~70 requests over ~50 seconds. No persistence, beaconing, or post-exploitation tooling has been attributed publicly at the time of the disclosure window.

## Affected and Fixed Versions

Vulnerable: PraisonAI 2.5.6 through 4.6.33 inclusive (PyPI: `praisonai`). At the moment of GHSA publication, the current PyPI release (4.6.33) was the most recent vulnerable build. The patched release 4.6.34 either enables authentication by default, removes the legacy `api_server.py` from the documented launch path, or binds the legacy server to loopback — operators are strongly advised to upgrade rather than configure-out the issue. The newer FastAPI-based server in the same project is not affected by this CVE.

## Remediation

- **Immediate:** Upgrade to PraisonAI ≥ 4.6.34. If upgrade is blocked, stop the legacy `api_server.py` process or bind it to 127.0.0.1 / a trusted private network. Block inbound traffic to ports running PraisonAI from the public internet.
- **Detection:** Alert on inbound `GET /agents` or `POST /chat` requests against any PraisonAI-hosting interface that lack an `Authorization` header. Alert on the literal string `CVE-Detector/1.0` in HTTP user-agent fields. Search HTTP logs back to 2026-05-11 13:56 UTC for requests to `/praisonai/version.txt`, `/api/agents/config`, `/api/mcp/config`.
- **Triage:** Audit model-provider (OpenAI, Anthropic, Google) billing dashboards from 2026-05-11 onward for unexplained usage spikes. Rotate any API keys, credentials, or tokens referenced from `agents.yaml`. Review agent definitions for tools (shell, code_interpreter, HTTP) that could have been weaponized, and assume those tools were invoked if the host was internet-exposed during the window.
- **Long-term:** Treat agent-framework launch entrypoints as production services subject to standard hardening (token auth, TLS, network segmentation, rate limiting, request logging). Bake AI-framework CVE feeds into routine vulnerability-management cadence given the demonstrated <24h exploitation pattern.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.001 Active Scanning: Scanning IP Blocks
- T1595.002 Active Scanning: Vulnerability Scanning
- T1595.003 Active Scanning: Wordlist Scanning
- T1592.002 Gather Victim Host Information: Software
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.006 Command and Scripting Interpreter: Python
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1552.001 Unsecured Credentials: Credentials In Files
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1684.001 Impersonation
- T1496 Resource Hijacking
- T1499.003 Endpoint Denial of Service: Application Exhaustion Flood

## Sources

- [CVE-2026-44338: PraisonAI authentication bypass in under 4 hours and the growing trend of rapid exploitation](https://webflow.sysdig.com/blog/cve-2026-44338-praisonai-authentication-bypass-in-under-4-hours-and-the-growing-trend-of-rapid-exploitation)
- [GHSA-6rmh-7xcm-cpxj — PraisonAI authentication bypass](https://github.com/advisories/GHSA-6rmh-7xcm-cpxj)
- [NVD CVE-2026-44338](https://nvd.nist.gov/vuln/detail/CVE-2026-44338)
- [PraisonAI — MervinPraison/PraisonAI GitHub repository](https://github.com/MervinPraison/PraisonAI)
- [PraisonAI on PyPI](https://pypi.org/project/praisonai/)
- [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)
- [CWE-668: Exposure of Resource to Wrong Sphere](https://cwe.mitre.org/data/definitions/668.html)
- [CWE-1188: Initialization of a Resource with an Insecure Default](https://cwe.mitre.org/data/definitions/1188.html)
- [CVE-2026-33626 — LMDeploy related rapid-exploitation case](https://nvd.nist.gov/vuln/detail/CVE-2026-33626)
- [CVE-2026-33017 — Langflow related rapid-exploitation case](https://nvd.nist.gov/vuln/detail/CVE-2026-33017)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0502