CVE-2026-57116 PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-57116?
CVE-2026-57116 is a critical vulnerability in MervinPraison PraisonAI, published on 23 Oct 2026.
Official description
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
Which versions are affected by CVE-2026-57116?
3 open source packages ship an affected version, including praisonai.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | From 4.2.1 | 4.6.59 |
praisonai PyPI | From 4.2.1 | 4.6.59 |
praisonai PyPI | From 4.2.1 | 4.6.59 |
How do I fix CVE-2026-57116?
Upgrade praisonai to 4.6.59 or later.
Is CVE-2026-57116 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57116 exists.
Sources
Also known as GHSA-892r-p3jq-jp24, PYSEC-2026-3507.