CVE-2026-57118: PraisonAI's AgentTeam.launch() served agents to anyone, no auth
Before praisonaiagents 1.6.59, the HTTP server started by AgentTeam.launch() (alias Agents.launch()) accepted requests with no token or a wrong one, and it binds to 0.0.0.0 by default. Anyone who could reach it could list agents and make them run, using your model credits, private context and tools.
What it is
AgentTeam.launch() registers GET /{path}/list, POST /{path} and POST /{path}/{agent_id}. The POST routes call agent.chat() directly, with no access check.
The default bind host for Agents.launch() is 0.0.0.0 and the docs show host="0.0.0.0" for remote access, so the endpoints are often reachable from the network. The advisory calls it a missed spot after nearby PraisonAI servers were hardened.
A separate critical advisory, CVE-2026-62176 (GHSA-g6j7-pffp-8whg), covers PraisonAI 4.6.77 and earlier: deploy/api.py pastes the agents_file value into generated Python code that it then runs, so whoever controls that value can inject code. It's fixed in PraisonAI 4.6.78.
How to check
- Affected: praisonaiagents (PyPI) before 1.6.59, and PraisonAI (PyPI) 4.6.77 and earlier for CVE-2026-62176.
- Look for code that calls AgentTeam.launch() or Agents.launch(), especially with host="0.0.0.0".
How to fix
- Upgrade praisonaiagents to 1.6.59 or later and PraisonAI to 4.6.78 or later.
- Bind agent servers to 127.0.0.1 unless you put authentication in front of them.
pip show praisonaiagents praisonai | grep -E '^(Name|Version)'