CVE-2026-56076: PraisonAI AGUI Endpoint Remote Agent Execution Vulnerability

Technical summary

The POST /agui endpoint in PraisonAI prior to 1.5.128 fails to implement authentication and unconditionally sets Access-Control-Allow-Origin: * in HTTP responses. Combined with Starlette's permissive JSON content-type parsing, this configuration allows attackers to bypass browser CORS preflight requirements through simple cross-origin requests. The endpoint does not validate the origin or session state of incoming requests, and returns full agent execution responses containing potentially sensitive tool outputs and environment data. An attacker can host a malicious page that, upon user interaction, silently submits requests to the vulnerable endpoint and reads the unfiltered response via JavaScript, achieving full agent command execution visibility without authentication.

Business impact

An attacker gaining access to agent execution responses can extract sensitive operational data, API keys, database credentials embedded in environment variables, and results from tools that interact with internal systems or external services. In multi-tenant or cloud deployments, this could enable lateral movement, data theft, or reconnaissance of internal infrastructure. The requirement for user interaction (via the CVSS UI:R flag) suggests a social engineering vector—users visiting a malicious site could unknowingly leak proprietary agent workflows, tool integrations, and system configurations. Organizations relying on PraisonAI for autonomous task execution face confidentiality and integrity risk until patching is complete.

Affected systems

PraisonAI versions prior to 1.5.128 are vulnerable. Organizations should verify their installed version immediately. The vulnerability is activated by network exposure of the /agui endpoint; isolated or internal-only deployments face reduced risk but should still upgrade to enforce defense-in-depth. No CVSS scope change is indicated, so attacks remain within the security scope of the application itself, though the damage (high confidentiality and integrity impact) remains severe.

Exploitability

Exploitation requires only network access to the vulnerable endpoint and the ability to trick a user into visiting an attacker-controlled page or clicking a malicious link. No sophisticated techniques are required; a simple HTML page with cross-origin fetch or form submission can trigger the vulnerability. The unauthenticated endpoint and permissive CORS headers eliminate authentication barriers. Attack complexity is low. However, the user interaction requirement (UI:R in CVSS) means the attack cannot be fully automated against passive targets—social engineering or targeting users already interacting with internal systems increases likelihood of success. Public exploit code is not yet known to be in active circulation, but the simplicity of the attack vector makes independent discovery likely.

Remediation

Upgrade PraisonAI to version 1.5.128 or later. Verify the upgrade with `pip show praison-ai` or equivalent package manager inspection. Additionally, apply network controls to restrict access to the /agui endpoint to trusted internal networks only, or disable it if not in use. Remove or replace the hardcoded Access-Control-Allow-Origin: * header with a whitelist of legitimate origins. Implement authentication and session validation on the endpoint, even if the primary data flow is internal. Review and rotate any secrets (API keys, database credentials, tokens) that may have been exposed in agent responses prior to patching.

Patch guidance

PraisonAI 1.5.128 introduces authentication enforcement and restricts CORS headers on the /agui endpoint. Verify the patch by consulting the official PraisonAI release notes or GitHub repository. Test the patched version in a staging environment to confirm agent execution functionality remains intact and that CORS policy changes do not break legitimate cross-origin workflows. Organizations should plan patching during maintenance windows to minimize disruption, though the patch is expected to be backward-compatible for correct usage patterns. If custom deployments or forks of PraisonAI are in use, ensure they incorporate this fix or apply equivalent controls manually.

Detection guidance

Monitor HTTP access logs for POST requests to /agui endpoints with Access-Control-Allow-Origin: * responses. Flag requests with Referer headers pointing to external or unexpected origins. Implement CORS policy violation logging at your reverse proxy or WAF layer. Search for agent execution logs showing unexpected tool invocations or environment variable exfiltration patterns. In application logs, look for multiple rapid requests to /agui from different IP addresses or user agents, which may indicate automated exploitation attempts. If you suspect compromise, review all agent responses and tool execution results logged between the vulnerability discovery date (2026-06-18) and your patch deployment date to identify unauthorized data access.

Why prioritize this

This vulnerability merits immediate patching despite not being on the CISA KEV list. The combination of unauthenticated access, full confidentiality and integrity impact, low attack complexity, and network-accessible endpoint creates a high-risk profile (CVSS 8.1). Organizations with internet-facing PraisonAI instances should treat this as a near-emergency remediation. Even internal deployments should prioritize patching to eliminate the social engineering vector and reduce insider risk. The user interaction requirement prevents fully automated worm-like propagation but does not reduce the severity of information disclosure.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: attack vector network (AV:N, remotely exploitable), low attack complexity (AC:L, no special conditions needed), no privileges required (PR:N, unauthenticated access), user interaction required (UI:R, social engineering needed), scope unchanged (S:U, impact within application), high confidentiality impact (C:H, sensitive data exposed), high integrity impact (I:H, arbitrary agent execution), and no availability impact (A:N, no denial of service). The high confidentiality and integrity scores dominate the rating despite the user interaction requirement, underscoring the severity of data exfiltration and unauthorized tool execution.

Frequently asked questions