PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authentication middleware. A remote caller who can reach the service can obtain agent names, roles, and instruction prefixes and can invoke a selected agent, potentially reaching its tools, memory, external APIs, credentials, and workflow state. An initial remediation

CVE-2026-57140 affects PraisonAI, a multi-agent teams system, in versions 1.6.0 through 1.7.2. The AgentOS component binds to 0.0.0.0 by default and exposes GET /api/agents and POST /api/chat endpoints without any authentication middleware. Any remote caller who can reach the service can enumerate agent names, roles, and instruction prefixes. Beyond information disclosure, an attacker can invoke agents directly, potentially gaining access to connected tools, memory stores, external APIs, stored credentials, and workflow state. The vulnerability stems from insecure default configuration in config.ts and missing authentication guards in agentos.ts. An initial remediation was released in version 1.7.2. Users are advised to upgrade immediately to mitigate unauthorized access risks.