Ghostwire

CVE-2026-61426: PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key...

HIGH CVSS 8.6 Exploit Available

Published: July 11, 2026 | Last Modified: July 11, 2026

Description

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.

Ghostwire Analysis — What This Means Practically

High CVSS score indicates significant risk — exploitation could lead to substantial data exposure or system compromise.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6wjp-v33h-5cvq
www.vulncheck.com/advisories/praisonai-before-unauthenticated-agent-access-via-i
www.tenable.com/cve/CVE-2026-61426
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-61426