CVE-2026-44338 Scanner
CVE-2026-44338 Scanner - Broken Authentication vulnerability in PraisonAI
Used 3.3k times · 5.9k assets checked · url
CVE
CVE-2026-44338
7.3
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
praisonai
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: praisonai
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →