CVE-2026-57140

PraisonAI versions 1.6.0 through versions prior to 1.7.2 ship an AgentOS component (src/praisonai-ts/src/os/agentos.ts) that binds to 0.0.0.0 and exposes GET /api/agents and POST /api/chat without any authentication middleware. Any remote attacker who can reach the listening service can enumerate agent names, roles, and instruction prefixes, then invoke a chosen agent via the chat endpoint. Because agents can be wired to tools, memory stores, external APIs, credentials, and workflow state, successful abuse can lead to disclosure of sensitive agent configuration and secrets as well as unauthorized execution of agent-driven actions. Affected parties are developers and organizations running the TypeScript AgentOS component of PraisonAI 1.6.x–1.7.x on a network-reachable host. The flaw is rated critical (CVSS 9.4, CWE-306); an initial fix shipped in 1.7.2, and no public PoC or in-the-wild exploitation is known.

What to do: Upgrade PraisonAI to version 1.7.2 or later (the initial remediation) and track subsequent releases for follow-up fixes. If the AgentOS service must run, bind it to 127.0.0.1 instead of 0.0.0.0 or place it behind an authenticated reverse proxy/firewall so /api/agents and /api/chat are not network-reachable. Review logs for unexpected calls to these endpoints and audit what tools, API credentials, and memory the exposed agents could have accessed.