https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T05:03:06.899419+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-339389 EUVD-2026-339389 2026-10-10T05:03:06.904451+00:00 EUVD-2026-339389 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47393 fkie_cve-2026-47393 2026-10-10T05:03:06.904496+00:00

PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that binds to `0.0.0.0` per the recommended sample YAML, exposes `/chat` and `/agents` endpoints, runs `praisonai.run()` on user-supplied JSON input — LLM orchestration with the API key materials present in the process environment, and does not require any authentication. Versions prior to 4.6.40 still ship the generator with `auth_enabled` defaulting to `False`. The fix shape is opt-in via `APIConfig(auth_enabled=True, auth_token=...)`. Version 4.6.40 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-8444-4fhq-fxpq GHSA-8444-4fhq-fxpq — PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default 2026-10-10T05:03:06.904565+00:00

Affected: PyPI: PraisonAI

### Summary

CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that:

- binds to `0.0.0.0` per the recommended sample YAML - exposes `/chat` and `/agents` endpoints - runs `praisonai.run()` on user-supplied JSON input — LLM orchestration with the API key materials present in the process environment - does not require any authentication

The PyPI wheel `praisonai==4.6.33` (current `@latest`) still ships the generator with `auth_enabled` defaulting to `False`. The fix shape is opt-in via `APIConfig(auth_enabled=True, auth_token=...)`.

### Details

**Anchor (file:line:symbol)**

- Vulnerable artifact: `praisonai==4.6.33` on PyPI. - Defaults: `praisonai/deploy/models.py:29` — `auth_enabled: bool = Field(default=False, ...)`; `praisonai/deploy/models.py:30` — `auth_token: Optional[str] = Field(default=None, ...)`. - Generator: `praisonai/deploy/api.py:40` — `AUTH_ENABLED = {config.auth_enabled}`; `api.py:41` — `AUTH_TOKEN = {repr(config.auth_token)}`; `api.py:43-49` — `def check_auth(): if not AUTH_ENABLED: return True`. - CLI entry: documented as `praisonai deploy --type api` (vendor README); produces the generator output above with no flag required to suppress the warning, because no warning is emitted.

**Vulnerable code (verbatim from…

 https://cve.radiocsirt.org/vuln/pysec-2026-465 PYSEC-2026-465 — PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default 2026-10-10T05:03:06.904708+00:00

Affected: PyPI: praisonai

### Summary

CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that:

- binds to `0.0.0.0` per the recommended sample YAML - exposes `/chat` and `/agents` endpoints - runs `praisonai.run()` on user-supplied JSON input — LLM orchestration with the API key materials present in the process environment - does not require any authentication The PyPI wheel `praisonai==4.6.33` (current `@latest`) still ships the generator with `auth_enabled` defaulting to `False`. The fix shape is opt-in via `APIConfig(auth_enabled=True, auth_token=...)`.

### Details

**Anchor (file:line:symbol)**

- Vulnerable artifact: `praisonai==4.6.33` on PyPI. - Defaults: `praisonai/deploy/models.py:29` — `auth_enabled: bool = Field(default=False, ...)`; `praisonai/deploy/models.py:30` — `auth_token: Optional[str] = Field(default=None, ...)`. - Generator: `praisonai/deploy/api.py:40` — `AUTH_ENABLED = {config.auth_enabled}`; `api.py:41` — `AUTH_TOKEN = {repr(config.auth_token)}`; `api.py:43-49` — `def check_auth(): if not AUTH_ENABLED: return True`. - CLI entry: documented as `praisonai deploy --type api` (vendor README); produces the generator output above with no flag required to suppress the warning, because no warning is emitted.

**Vulnerable code (verbatim fro…