CVE-2026-56076 PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint
Remote attackers can execute arbitrary agents and exfiltrate sensitive data via an unauthenticated endpoint with wildcard CORS settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-56076?
CVE-2026-56076 is a high-severity missing authorization vulnerability in PraisonAI, published on 18 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, combined with Starlette's Content-Type-agnostic JSON parsing, enabling attackers to bypass CORS preflight checks via simple requests and exfiltrate sensitive agent responses including tool execution results and environment data.
Weakness: CWE-942
Which versions are affected by CVE-2026-56076?
How do I fix CVE-2026-56076?
No fix has been published for CVE-2026-56076 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-56076 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56076 exists.
Sources
Also known as GHSA-5fr5-2c3f-3fcr.