CVE-2026-57118

Summary

A vulnerability in PraisonAI allows unauthenticated attackers to enumerate agents, access private context, and trigger agent workflows without any authentication checks, potentially leading to unauthorized resource consumption and data exposure.

Exploitability

Exploitation is straightforward with no prerequisites, as the vulnerable endpoints accept GET and POST requests without access control checks, making it easy for remote attackers to enumerate agents and invoke agent functions.

Blast radius

The impact could be significant as attackers can consume model resources, access private context data, and trigger agent tools or workflows, potentially leading to unauthorized data processing and exposure of sensitive information.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to praisonaiagents 1.6.59 immediately to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.