PraisonAI Insecure Default Configuration Exposes API Endpoints

Executive Summary

PraisonAI versions before 1.7.3 have an insecure default configuration that causes the server to bind to all network interfaces without requiring an API key and enables wildcard CORS with credentials.

Because authentication middleware is only activated when an API key is explicitly set, this default setup leaves critical endpoints accessible to any network peer without authentication.

• GET /api/agents endpoint allows attackers to read sensitive agent instructions and system prompts.
• POST /api/chat endpoint allows attackers to invoke agents without authentication.

This vulnerability arises from missing authentication checks, permissive CORS settings, and binding to all interfaces, enabling unauthenticated attackers to access and misuse agent data and functionality.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts including unauthorized access to sensitive agent metadata and system prompts.

Attackers can execute arbitrary agent commands without authentication, potentially abusing large language model (LLM) costs or tools integrated with PraisonAI.

Because the server binds to all interfaces and lacks authentication by default, any network peer can exploit these endpoints, leading to confidentiality breaches and unauthorized actions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the PraisonAI server is binding to all network interfaces (0.0.0.0) without requiring an API key and if the endpoints /api/agents and /api/chat are accessible without authentication.

You can use network scanning or HTTP request commands to test accessibility of these endpoints.

• Use curl to send a GET request to check if /api/agents is accessible without authentication: curl -v http://<server-ip>:<port>/api/agents
• Use curl to send a POST request to /api/chat to see if agent invocation is possible without authentication: curl -v -X POST http://<server-ip>:<port>/api/chat -d '{}'
• Check the server binding address by inspecting the PraisonAI configuration or running netstat to see if it listens on 0.0.0.0: netstat -tuln | grep <port>

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include changing the default configuration of PraisonAI to enhance security.

• Bind the PraisonAI server to localhost (127.0.0.1) instead of all network interfaces (0.0.0.0) to restrict external access.
• Configure and require an API key for authentication to ensure that only authorized users can access the API endpoints.
• Disable wildcard CORS settings with credentials to prevent unauthorized cross-origin requests.
• Upgrade PraisonAI to version 1.7.3 or later where these insecure defaults are fixed.

Useful 0 Not Useful 0