CVE-2026-57118 PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
Unauthenticated remote attackers can enumerate agents and trigger tools or workflows in PraisonAI, leading to data exposure and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57118?
CVE-2026-57118 is a critical missing authorization vulnerability in MervinPraison PraisonAI, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.
Which versions are affected by CVE-2026-57118?
3 open source packages ship an affected version, including praisonaiagents.
| Package | Affected | Fixed in |
|---|---|---|
praisonaiagents PyPI | All versions | 1.6.59 |
praisonaiagents PyPI | All versions | 1.6.59 |
praisonaiagents PyPI | All versions | 1.6.59 |
How do I fix CVE-2026-57118?
Upgrade praisonaiagents to 1.6.59 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-57118 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57118 exists.
Sources
Also known as GHSA-x8cv-xmq7-p8xp, PYSEC-2026-3537.