# PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)

- **Severity:** Critical
- **Signature ID:** `9134d655-4705-44fc-a4d9-7b0f3e560e20`
- **CVEs:** CVE-2026-44338
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access), AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), ASI06 (Goal and Instruction Manipulation), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

PraisonAI, a framework for building AI agents, shipped a legacy API server that exposes agent execution endpoints without requiring any login or token. Anyone who can reach the server over the network can trigger agent actions, and attackers began exploiting this within hours of the flaw becoming public.

## How the attack works

PraisonAI's api_server.py exposes /agents and /chat HTTP endpoints that accept requests with no authentication check. An attacker finds an exposed instance and sends a plain POST request to one of these endpoints. Because there's no auth requirement, the request is accepted and PraisonAI executes the requested agent or chat action on the host. This gives the attacker the ability to run arbitrary agent workflows, extract data those agents can access, or use the agent's tools for further actions, all without credentials.

## Why it matters

An attacker can remotely trigger agent execution on any exposed PraisonAI server, potentially accessing whatever data or tools those agents are connected to, with no login required. This can lead to data exposure, abuse of connected tools, or use of the server as a foothold for further attacks.

## What you can do

- Upgrade PraisonAI to version 4.6.34 or later, which fixes this issue.
- Never expose the /agents or /chat endpoints directly to the internet; require authentication at the application layer or restrict access via VPN/firewall to trusted networks only.
- Audit existing deployments for versions 2.5.6 through 4.6.33 and check logs for POST requests to these endpoints from unexpected sources.
- Add authorization headers/tokens to all agent API calls and reject requests that lack them.

## Known benign look-alikes

- Internal-only PraisonAI deployments accessible solely over authenticated VPN where the API endpoint is intentionally gated by perimeter auth.
- Security scanning tooling that probes the PraisonAI API endpoint to detect CVE-2026-44338 exposure.
- Educational documentation describing the PraisonAI API architecture.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00531
- https://nvd.nist.gov/vuln/detail/CVE-2026-44338

---
Source: https://www.netzilo.com/threats/atr-praisonai-unauthenticated-agent-api-exploitation-cve-2026-44