CVE-2026-44338 PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution
Unauthenticated attackers can execute arbitrary AI workflows and access agent data in PraisonAI due to disabled authentication in the default legacy API server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44338?
CVE-2026-44338 is a high-severity missing authorization vulnerability in MervinPraison PraisonAI, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
Which versions are affected by CVE-2026-44338?
3 open source packages ship an affected version, including praisonai and PraisonAI. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | From 2.5.6 | 4.6.34 |
praisonai PyPI | From 2.5.6 | 4.6.34 |
PraisonAI PyPI | From 2.5.6 | 4.6.34 |
Products include Praison Praisonai.
How do I fix CVE-2026-44338?
Upgrade praisonai to 4.6.34 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-44338 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44338 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in MervinPraison PraisonAI
- CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
- CVE-2026-41497 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI
- CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML
- CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
- CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
Sources
Also known as GHSA-6rmh-7xcm-cpxj, PYSEC-2026-2904.