CVE-2026-44338highobserved exploitationCWE-1188 CWE-306 CWE-668

CVE-2026-44338: high-severity vulnerability in MervinPraison PraisonAI

PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

Published 08 May 2026

78Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 7.3epss 0.8%

from disclosure to weapon7 days

Published on NVDMay 8

1st PoC+7d

VulnCheck+4d

exploitation probability

0.8%top 44% of all CVEs

observed exploitation

yesVulnCheck

2 public exploit(s)

In short

PraisonAI includes a legacy API server that runs without authentication by default, allowing anyone who can reach it to execute workflows and access agent configurations without needing credentials.

Technical detail

The legacy Flask API server in PraisonAI versions 2.5.6 to before 4.6.34 exposes /agents and /chat endpoints without authentication checks, enabling unauthenticated remote workflow execution (CWE-306) and information disclosure via CWE-668. Attack vector is network-based for any instance accessible without firewall restrictions.

Summary generated and translated by AI from the official description.

PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

MervinPraison · PraisonAI

public PoCs found — 2

githubgithub.com/HORKimhab/CVE-2026-44338★ 0 githubgithub.com/rootdirective-sec/CVE-2026-44338-Lab★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.