Vulnerability intelligence
CVE-2026-44338
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
CVSS Score
7.3
High
EPSS — Exploit Probability
27%
Riskier than 98% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
2 articles across 2 outlets · first covered May 14, 2026 · latest May 14, 2026
Coverage timeline
-
PraisonAI flaw exploited hours after CVE-2026-44338 disclosurethehackernews.com · May 14, 2026
-
PraisonAI auth bug exploited hours after CVE-2026-44338 revealwww.securityweek.com · May 14, 2026