PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS

The primary impact of CVE-2026-40151 is the exposure of sensitive agent data. An attacker could leverage this information to gain insights into the deployed agents' roles and functionalities, potentially aiding in reconnaissance for further attacks. While the initial system instructions are truncated to 100 characters, this partial exposure can still reveal valuable clues about the agents' intended behavior and configuration. The lack of authentication and the permissive CORS settings (allowing all origins) significantly broaden the attack surface, making exploitation straightforward from any network location. This vulnerability resembles scenarios where internal system details are inadvertently exposed via misconfigured APIs, potentially leading to privilege escalation or data breaches.

1. Reservado2026-04-09
2. Publicada2026-04-10
3. EPSS atualizado2026-04-17

The recommended mitigation for CVE-2026-40151 is to immediately upgrade praisonai to version 4.5.128 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the AgentOS deployment platform using firewalls or network segmentation to limit exposure. Implement API authentication middleware to require valid credentials for accessing the /api/agents endpoint. Configure CORS to restrict allowed origins to trusted domains only. While not a direct fix, these steps can reduce the attack surface and limit the potential impact of the vulnerability.