CVE-2026-40116 PraisonAI's Unauthenticated WebSocket Endpoint Proxies to Paid OpenAI Realtime API Without Rate Limits
Unauthenticated attackers can exhaust server resources and drain OpenAI API credits via an unprotected WebSocket endpoint in PraisonAI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40116?
CVE-2026-40116 is a high-severity missing authorization vulnerability in MervinPraison PraisonAI, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenticated session to OpenAI's Realtime API using the server's API key. There are no limits on concurrent connections, message rate, or message size, allowing an unauthenticated attacker to exhaust server resources and drain the victim's OpenAI API credits. This vulnerability is fixed in 4.5.128.
Weakness: CWE-770
Which versions are affected by CVE-2026-40116?
3 open source packages ship an affected version, including praisonai and PraisonAI. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | All versions | 4.5.128 |
praisonai PyPI | All versions | 4.5.128 |
PraisonAI PyPI | All versions | 4.5.128 |
Products include Praison Praisonai.
How do I fix CVE-2026-40116?
Upgrade praisonai to 4.5.128 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-40116 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40116 exists.
Other vulnerabilities in MervinPraison PraisonAI
- CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
- CVE-2026-41497 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI
- CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML
- CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
- CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
Sources
Also known as GHSA-q5r4-47m9-5mc7, PYSEC-2026-2920.