CVE-2026-56076
PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.74%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, combined with Starlette's Content-Type-agnostic JSON parsing, enabling attackers to bypass CORS preflight checks via simple requests and exfiltrate sensitive agent responses including tool execution results and environment data.
- CVSS 4.0
- 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.74% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-942
- Source
- disclosure@vulncheck.com
References
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x462-jjpc-q4q4
- https://www.vulncheck.com/advisories/praisonai-cross-origin-agent-execution-via-hardcoded-wildcard-cors-and-missing-authentication-on-agui-endpoint
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x462-jjpc-q4q4
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.