CVE Dashboard
Back to Dashboard

CVE-2026-61426

Published: July 11, 2026•Last Modified: July 11, 2026
CVSS SCORE
8.6
HIGH

Vulnerability Description

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.

Affected Products & Versions

No configurations parsed from local entry.

Security Advisories & References

Mitigation & Remediation

Update the affected packages to a secure version. Refer to vendor security advisories.

Share Advisory

Copy the standardized markdown formatted vulnerability report to post in Slack, Teams, email, or ticketing systems.

# HIGH - CVE-2026-61426 ## EFFECT PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication. ## AFFECTED Unknown products ## LINKS - [github.com](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6wjp-v33h-5cvq) - [www.vulncheck.com](https://www.vulncheck.com/advisories/praisonai-before-unauthenticated-agent-access-via-insecure-defaults) ## SOLUTION - Update the affected packages to a secure version. Refer to vendor security advisories.