PraisonAI CVE-2026-44338 Auth Bypass Targeted Within Hours of Disclosure

Threat actors are actively exploiting a critical authentication bypass vulnerability in PraisonAI within hours of disclosure.

• •CVE-2026-44338 (CVSS 7.3) involves missing authentication on PraisonAI's Flask API server, allowing unauthenticated access to /agents and /chat endpoints
• •The legacy API server has AUTH_ENABLED = False and AUTH_TOKEN = None hardcoded, affecting versions 2.5.6 through 4.6.33
• •Exploitation enables unauthenticated enumeration of agent configurations, triggering workflows, consuming API quotas, and exposing results
• •Security researcher Shmulik Cohen discovered the flaw; Sysdig observed exploitation attempts within 3 hours 44 minutes of public disclosure
• •Fixed in version 4.6.34; users advised to patch immediately, audit deployments, and rotate credentials in agents.yaml