Organisations Urged to Update PraisonAI 1.6.59 After CVSS 9.8 Flaw Exposed Agent Workflows and Data
A critical flaw in PraisonAI allowed anyone to access agent systems. Version 1.6.59 patches the missing access controls that exposed workflows and data.
Key points
- CVE-2026-57118 is rated CVSS 9.8 Critical by the NVD.
- The flaw existed in praisonaiagents versions prior to 1.6.59.
- Attackers could list agents, use resources, and trigger tools without login.
Organisations using PraisonAI should update their systems to block unauthenticated access to agent teams. The National Vulnerability Database records CVE-2026-57118 as a critical vulnerability with a CVSS score of 9.8. This flaw allows remote attackers to bypass authentication entirely, potentially accessing multi-agent systems. The issue affects the praisonaiagents package in versions older than 1.6.59.
How it unfolded
- PraisonAI is a multi-agent teams system designed for complex workflows.
- Prior to version 1.6.59, the AgentTeam.launch function lacked security checks.
- The Agents alias registered specific API endpoints without access-control verification.
- These endpoints included GET requests to list agents and POST requests to interact with them.
- The missing controls allowed unauthenticated clients to reach these functions directly.
Who is affected
Any deployment of PraisonAI using praisonaiagents versions before 1.6.59 is vulnerable. The NVD record identifies the affected software as MervinPraison PraisonAI less than version 4.6.59 and MervinPraison praisonaiagents less than 1.6.59. The vulnerability involves weaknesses classified as CWE-306 and CWE-862. These categories relate to missing authentication and incorrect permission assignments. The risk is highest for servers exposed to the internet or untrusted networks.
Our take on the response
The vendor has released a fix in praisonaiagents 1.6.59. This update addresses the missing access-control checks on the AgentTeam.launch and Agents alias functions. By patching these endpoints, the update stops unauthenticated users from enumerating agents or triggering workflows. The high severity score reflects the ease with which an attacker can exploit the flaw. That suggests rapid adoption of the patch is necessary to prevent resource abuse and data leakage.
What to do and how to stay safe: PraisonAI
- Inventory all servers running PraisonAI to identify versions of praisonaiagents older than 1.6.59.
- Apply the 1.6.59 update to restore access-control checks on agent listing and interaction endpoints.
- Review server logs for unauthorized GET requests to list agents or POST requests to trigger tools.
- Restrict network access to PraisonAI endpoints to ensure only authenticated clients can connect.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-57118?
It is a critical vulnerability in PraisonAI that allows unauthenticated access to agent teams and private context.
Which versions are affected?
PraisonAI versions prior to 4.6.59 and praisonaiagents versions prior to 1.6.59 are affected.
Is there a fix available?
Yes, the vulnerability is fixed in praisonaiagents version 1.6.59.
