PraisonAI AgentOS - Information Disclosure

mediumseverity

5.3CVSS score

0.8%likelihood of exploitation, next 30 days

56%of all CVEs are less likely

Readycheck to confirm it

PraisonAI's AgentOS FastAPI application server exposes an unauthenticated `GET /api/agents` endpoint that lists every registered agent's name, role and the opening of its instructions (system prompt). No authentication is enforced on the route, allowing a remote attacker to enumerate agent configurations and harvest sensitive details embedded in system prompts, such as internal API references, business logic and credential hints. This endpoint belongs to the AgentOS FastAPI server and is distinct from the legacy Flask `/agents` server tracked as CVE-2026-44338.

Impact

An unauthenticated attacker can disclose agent names, roles and system-prompt content, which frequently contains proprietary business logic, internal endpoints and credential hints.

Fix

Upgrade PraisonAI to version 4.5.128 or later and restrict network access to the AgentOS API.

How to confirm it

Send: GET {{BaseURL}}/api/agents
Positive when: contains "\"agents\"" and "\"role\"" and "\"instructions\"" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2026-40151 -u <target>

The full check

id: CVE-2026-40151

info:
  name: PraisonAI AgentOS - Information Disclosure
  author: aryu-ru
  severity: medium
  description: |
    PraisonAI's AgentOS FastAPI application server exposes an unauthenticated `GET /api/agents` endpoint that lists every registered agent's name, role and the opening of its instructions (system prompt). No authentication is enforced on the route, allowing a remote attacker to enumerate agent configurations and harvest sensitive details embedded in system prompts, such as internal API references, business logic and credential hints. This endpoint belongs to the AgentOS FastAPI server and is distinct from the legacy Flask `/agents` server tracked as CVE-2026-44338.
  impact: |
    An unauthenticated attacker can disclose agent names, roles and system-prompt content, which frequently contains proprietary business logic, internal endpoints and credential hints.
  remediation: |
    Upgrade PraisonAI to version 4.5.128 or later and restrict network access to the AgentOS API.
  reference:
    - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pm96-6xpr-978x
    - https://nvd.nist.gov/vuln/detail/CVE-2026-40151
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-40151
    epss-score: 0.00758
    epss-percentile: 0.55539
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    vendor: praison
    product: praisonai
    shodan-query: http.html:"PraisonAI App"
    fofa-query: body="PraisonAI App"
  tags: cve,cve2026,praisonai,praison,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/agents"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"agents"'
          - '"role"'
          - '"instructions"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '"role"\s*:\s*"([^"]+)"'

References

Use this check only on systems you are authorised to test. Where the data comes from