CVE-2026-61426 — PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults
PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call …
Published: 2026-07-11 · CVSS: 8.8 · CVSS 4.0
PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7