PraisonAI’s Open-Source Agent Framework Shipped With Auth Disabled — Attackers Probed It in Under 4 Hours

A critical authentication bypass in the PraisonAI multi-agent orchestration framework, tracked as CVE-2026-44338 with a CVSS score of 7.3, was probed by an automated scanner 3 hours, 44 minutes, and 39 seconds after a GitHub advisory published on May 11, 2026 at 13:56 UTC. The CWE-306 flaw in src/praisonai/api_server.py hard-codes AUTH_ENABLED to False and AUTH_TOKEN to None in versions 2.5.6 through 4.6.33, making check_auth() return True by default; a scanner using the User-Agent "CVE-Detector/1.0" from DigitalOcean IP 146.190.133.49 confirmed the bypass with a single GET request to /agents that returned 200 OK without an Authorization header. Sysdig Director of Threat Research Michael Clark said the operating assumption for any project shipping an unauthenticated default must be that the window between disclosure and active exploitation is measured in single-digit hours.

On May 11, 2026, at 13:56 UTC, a GitHub advisory was published detailing a critical vulnerability in the PraisonAI multi-agent orchestration framework. Exactly 3 hours, 44 minutes, and 39 seconds later, the first targeted probe hit a vulnerable instance. The vulnerability, tracked as CVE-2026-44338 https://github.com/advisories/GHSA-6rmh-7xcm-cpxj , carries a CVSS score of 7.3. It is a classic CWE-306 Missing Authentication for Critical Function flaw, compounded by CWE-668 https://cwe.mitre.org/data/definitions/668.html and CWE-1188 https://cwe.mitre.org/data/definitions/1188.html . The root cause is located in the legacy Flask API server within the PraisonAI Python package, specifically in src/praisonai/api server.py. In affected versions 2.5.6 through 4.6.33, the variables AUTH ENABLED and AUTH TOKEN are hard-coded to False and None, respectively. Consequently, the check auth function returns True by default, rendering authentication entirely optional. The reconnaissance activity observed shortly after the advisory publication provides a clear view of how automated scanners operate in this space. Using the User-Agent “CVE-Detector/1.0” from a DigitalOcean IP address 146.190.133.49 , the scanner executed two distinct passes separated by eight minutes. The first pass targeted generic paths like /.env and /admin, while the second focused on AI-agent specific surfaces, including /praisonai/version.txt and /api/agents. The scanner successfully confirmed the bypass with a single GET request to /agents, which returned a 200 OK status without requiring an Authorization header. Notably, the scanner did not attempt to trigger the /chat endpoint, suggesting the initial objective was mapping the attack surface rather than immediate exploitation. The impact of this vulnerability is bounded by the capabilities defined in the operator’s agents.yaml workflow. While not an arbitrary code execution vulnerability in the traditional sense, the unconditional authentication bypass allows unauthorized actors to enumerate configured agents and potentially trigger workflows. This pattern of trust-through-defaults has been observed at the platform or protocol layer, as seen in recent discussions regarding Azure AI Foundry https://forkast.news/azure-ai-foundry-had-a-cvss-10-0-authentication-bypass-microsoft-fixed-it-silently-and-told-nobody/ , MCP SDK OAuth implementations https://forkast.news/anthropics-official-mcp-python-sdk-had-an-oauth-credential-stealing-flaw-that-let-any-malicious-server-hijack-your-login/ , the CARBONATO botnet https://forkast.news/carbonato-is-the-first-botnet-where-the-command-and-control-engine-is-an-ai-agent-and-it-has-been-running-since-october-2024/ , and the SalesBleed incident https://forkast.news/salesforce-agentforce-got-zero-clicked-through-its-own-web-form-and-the-attack-vector-is-in-every-agent-that-combines-these-three-things/ . With CVE-2026-44338, this pattern has migrated into the orchestration framework layer itself, where developers often prioritize ease of use over secure-by-default configurations. Trey Ford, Chief Strategy and Trust Officer at Bugcrowd, notes that organizations accelerating AI agent adoption without auditing network binding, authentication defaults, and credential exposure in configuration files now face risks they likely have not quantified. This sentiment is echoed by Vineeta Sangaraju, an AI Research Engineer at Black Duck, who emphasizes that any AI service reachable from the internet should be treated as a production asset with rigorous controls around authentication, network segmentation, and monitoring. Michael Clark, Director of Threat Research at Sysdig, points out that adversary tooling has scaled to the entire AI and agent ecosystem, regardless of project size. The operating assumption for any project shipping an unauthenticated default must be that the window between disclosure and active exploitation is measured in single-digit hours. These observations are based on available security data; there is no evidence of widespread exploitation beyond this initial reconnaissance phase. For defenders, the remediation path is straightforward: upgrade to PraisonAI version 4.6.34 or later. The newer “serve agents” command in the framework correctly binds to 127.0.0.1 and supports –api-key, addressing the insecure defaults of the legacy server. In the interim, security teams should monitor for requests to /agents and /chat that lack an Authorization header. Additionally, anomalous access to files such as /praisonai/version.txt, pyproject.toml, or requirements.txt should be treated as indicators of reconnaissance.