CVE-2026-61426CWE-200

PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults

High · published July 11, 2026

CVSS v4.0
8.8
EPSS
0%
Percentile
40.3
In the wild
Unconfirmed
What it is

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00478 · 40.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-07-11T13:01Z
EPSS history
Timeline
  • 11 JUL 13:01Z
    PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults
    cvelistv5