CVE-2026-44338
Published: 08 May 2026
Summary
CVE-2026-44338 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Praison Praisonai. Its CVSS base score is 7.3 (High).
Operationally, ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.
Tailoring replaces or augments insecure default initializations with system-specific values and compensating controls before deployment.
Knowing every system allows confirmation that critical functions are not left without required authentication mechanisms.
Tools routinely check for missing authentication on critical functions and exposed interfaces.
Training emphasizes enabling and properly using authentication for critical functions, reducing missing authentication exposures.
Secure configuration documentation explicitly addresses enabling authentication for critical functions, reducing missing authentication exposures.
Requires authentication gates on critical functions that must remain unavailable to anonymous public users.
Public components are isolated in separate subnetworks and critical internal functions are reachable only via controlled interfaces.
NVD Description
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and…
more
trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.
Deeper analysisAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)