PraisonAI's 28 Advisories: Agent Servers That Ship Without Auth

On 7 and 8 October 2026, GitHub's advisory database published 28 advisories for the PraisonAI multi-agent framework: 15 against the praisonai Python package, 9 against praisonaiagents, 3 against praisonai-platform and 1 against the praisonai npm package. Three are rated critical. The fixes themselves shipped in late June, so this is less a fire drill than a reminder to check which PraisonAI servers you started and never stopped.

The pattern across the batch is consistent. Several network services only add authentication when an API key happens to be set, and two safety controls (a sandbox policy and a human approval step) did less than their names suggest.

What's affected

All three Python packages list the same cut line:

• praisonai 4.6.77 and earlier. The advisories name 4.6.78 as the fix, but PyPI has no 4.6.78. The first release above 4.6.77 is 4.6.81, uploaded 27 June 2026. The current release is 4.7.15.
• praisonaiagents 1.6.77 and earlier, fixed in 1.6.78 (uploaded 25 June 2026).
• praisonai-platform 0.1.8 and earlier, fixed in 0.1.9 (uploaded 25 June 2026).
• praisonai on npm before 1.7.3, fixed in 1.7.3.

The ones that matter most, by what an attacker needs:

• CVE-2026-61447 (critical, CVSS 10.0): CodeAgent._execute_python() ran model-generated Python with a full copy of the parent environment, no import restrictions and no sandbox, even with CodeConfig(sandbox=True). Prompt injection in anything the agent reads becomes code execution plus every secret in os.environ.
• CVE-2026-61445 (critical, 9.9): the AICoder UI component gave the model write_to_file and execute_command tools with no path validation or command filtering.
• CVE-2026-62176 (critical, 9.1): code injection through f-string interpolation when generating a deploy API server.
• CVE-2026-61427 (high): praisonai mcp serve --transport http-stream defaults --api-key to none, so anyone who can reach the port can initialize and tools/list about 50 tools. Tool arguments were not checked against the advertised schema.
• CVE-2026-60091 (high): the Async Jobs API only adds its key middleware when PRAISONAI_JOBS_API_KEY is set. An unauthenticated POST /api/v1/runs accepted a webhook_url, and a DNS rebinding gap turned that into blind SSRF.
• CVE-2026-61435 (high): with PRAISONAI_CALL_AUTH=disabled, the "localhost only" check read the hostname from the request, so a spoofed Host: 127.0.0.1 header let a network caller list and invoke agents.
• CVE-2026-61426 (high, npm): the TypeScript AgentOS server bound 0.0.0.0 with no API key and wildcard CORS, exposing GET /api/agents (system prompts) and POST /api/chat.
• CVE-2026-60085 (high): SecurityPolicy.strict() fields like blocked_paths and allow_subprocess were never read by the default SubprocessSandbox. The reporter ran id and read /etc/passwd under a strict policy.
• CVE-2026-60087 (medium): human approval was cached by tool name only. Approve one write_file call and every later write_file call in that run went through with any arguments.

The rest cover path traversal in context loaders, webhook signature checks for AgentMail, SSRF bypasses in web_crawl, prompt injection detector thresholds, and authorization gaps between platform members.

How to check if you're exposed

Find every install, including transitive ones pulled in by internal tools:

pip show praisonai praisonaiagents praisonai-platform 2>/dev/null | grep -E '^(Name|Version)'
npm ls praisonai 2>/dev/null
grep -rniE 'praisonai(agents)?' requirements*.txt pyproject.toml poetry.lock uv.lock 2>/dev/null

Then find which servers are actually running and reachable. Version alone overstates risk here, because most of the high findings need a listening service:

ps aux | grep -iE 'praisonai (mcp serve|serve|ui|call)' | grep -v grep
ss -ltnp | grep -i python

For each listener, note the bind address. A service on 0.0.0.0 or behind a public load balancer is the priority. Check whether PRAISONAI_JOBS_API_KEY is set for the Jobs API, whether the MCP server was started with --api-key, and whether PRAISONAI_CALL_AUTH=disabled appears in any environment file.

For the library bugs, search your code for the risky entry points:

grep -rnE 'CodeAgent|AICoder|SecurityPolicy\.strict|SubprocessSandbox' --include=*.py .

If you use CodeAgent on input from users, documents, email or web pages, treat CVE-2026-61447 as reachable.

What to do now

1. Upgrade praisonai to 4.6.81 or later (4.7.15 is current), praisonaiagents to 1.6.78 or later, praisonai-platform to 0.1.9 or later, and the npm praisonai package to 1.7.3 or later. Pin the Python packages together so they don't drift.
2. Set an API key on every PraisonAI server you run, even on localhost: --api-key for the MCP server, PRAISONAI_JOBS_API_KEY for the Jobs API, and an explicit key for AgentOS.
3. Remove PRAISONAI_CALL_AUTH=disabled from any environment that is reachable from another machine.
4. Rotate secrets that lived in the environment of any process running CodeAgent on untrusted input. The advisory says the full environment was passed to generated code.
5. Run code execution agents inside a container or VM with no cloud credentials mounted. Don't rely on an in-process policy object as the boundary.
6. Re-review any approval flow you built on the approval registry. Before the fix, one approval covered every later call to that tool in the run.

Why it matters

Agent frameworks are moving faster than their threat models. "Auth only if a key is configured" is a fine default for a laptop demo and a bad one for anything a teammate deploys to a shared VM. Three separate PraisonAI services followed that pattern, and the npm one also bound to all interfaces.

The sandbox and approval findings are the more useful lesson. A security control that exists as configuration but isn't enforced is worse than none, because people stop looking. When you adopt an agent framework, test its guardrails the way the reporters did: set the strictest policy, then try to read /etc/passwd.

Try it yourself

Build a list of the agent frameworks in one service and the network ports each one opens. An AI bill of materials makes that inventory concrete:

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GHSA-2xv2-w8cq-5gxw: CodeAgent executes LLM-generated code without sandboxing (CVE-2026-61447)
• GHSA-9mp3-24cc-77mg: AICoder arbitrary file write and command execution (CVE-2026-61445)
• GHSA-g6j7-pffp-8whg: Code injection in deploy API server generation (CVE-2026-62176)
• GHSA-hc5v-gxvj-58wh: MCP HTTP-stream transport unauthenticated by default (CVE-2026-61427)
• GHSA-4w49-gwv8-fpjg: Jobs API unauthenticated with webhook SSRF (CVE-2026-60091)
• GHSA-2gpf-2492-q9jh: Call API Host header bypass (CVE-2026-61435)
• GHSA-6wjp-v33h-5cvq: AgentOS network-exposed no-auth default (CVE-2026-61426)
• GHSA-5r6c-gj4g-r697: SecurityPolicy unenforced by SubprocessSandbox (CVE-2026-60085)
• GHSA-29r9-67vg-qj56: Tool approval cached by tool name (CVE-2026-60087)
• praisonai on PyPI
• praisonaiagents on PyPI