PT-2026-57434 · Praisonai · Praisonai

Dinhvaren · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-61426

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.7.3

Description The software has an insecure default configuration that binds to all network interfaces, lacks API key requirements, and uses wildcard CORS (Cross-Origin Resource Sharing), which allows resources to be requested from any domain. Unauthenticated attackers can access the 'GET /api/agents' endpoint to read agent instructions and system prompts, or use the 'POST /api/chat' endpoint to invoke agents.

Recommendations Update PraisonAI to version 1.7.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-61426

Affected Products

Praisonai

References · 5

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6wjp-v33h-5cvq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61426 · Security Note
• https://vulncheck.com/advisories/praisonai-before-unauthenticated-agent-access-via-insecure-defaults · Note
• https://twitter.com/infoflowcloud/status/2076042788467003509 · Twitter Post
• https://twitter.com/CVEnew/status/2076040493293580795 · Twitter Post