https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 16:42:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335954 EUVD-2026-335954 https://cve.radiocsirt.org/vuln/euvd-2026-335954 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61426 <p>PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.</p> <p>PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-61426 https://cve.radiocsirt.org/vuln/ghsa-6wjp-v33h-5cvq <p><strong>Affected:</strong> npm: praisonai</p> <p>## Summary</p> <p>The AgentOS server in the `praisonai` TypeScript/npm package ships an insecure default: it binds `0.0.0.0`, sets no API key, and uses CORS `*` with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart (`new AgentOS({agents:[...]}).serve({port})`) exposes, **unauthenticated**, `GET /api/agents` (which leaks agent names/roles/instructions, i.e. system prompts) and `POST /api/chat` (which invokes agents). Any network peer can read agent system prompts and drive the agent. Runtime-confirmed; severity High.</p> <p>## Details</p> <p>### Affected component - Package: `praisonai` (npm / TypeScript). Files `src/praisonai-ts/src/os/config.ts` and `src/praisonai-ts/src/os/agentos.ts` (`AgentOS`).</p> <p>### Vulnerable code / root cause</p> <p>Path: `src/praisonai-ts/src/os/config.ts`</p> <p>Class/const: `DEFAULT_AGENTOS_CONFIG` / `mergeConfig`</p> <p>Snippet: ```ts export const DEFAULT_AGENTOS_CONFIG = { host: &#39;0.0.0.0&#39;, corsOrigins: [&#39;*&#39;], apiKey: &#39;&#39;, // ... }; // mergeConfig: apiKey = userConfig?.apiKey ?? process.env.PRAISONAI_AGENTOS_API_KEY ?? &#39;&#39;; ``` Issue: defaults bind all interfaces, with an empty API key and wildcard CORS. `apiKey` stays empty unless the developer explicitly sets it.</p> <p>Path: `src/praisonai-ts/src/os/agentos.ts`</p> <p>Function: `serve` / `_registerRoutes` (Express app)</p> <p>Snippet: ```ts if (this.config.apiKey) { // auth middleware ONLY added when apiKey is set app.use((req,res,next) =&gt; { /* 401 unless Bearer…</p> <p><strong>Affected:</strong> npm: praisonai</p> <p>## Summary</p> <p>The AgentOS server in the `praisonai` TypeScript/npm package ships an insecure default: it binds `0.0.0.0`, sets no API key, and uses CORS `*` with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart (`new AgentOS({agents:[...]}).serve({port})`) exposes, **unauthenticated**, `GET /api/agents` (which leaks agent names/roles/instructions, i.e. system prompts) and `POST /api/chat` (which invokes agents). Any network peer can read agent system prompts and drive the agent. Runtime-confirmed; severity High.</p> <p>## Details</p> <p>### Affected component - Package: `praisonai` (npm / TypeScript). Files `src/praisonai-ts/src/os/config.ts` and `src/praisonai-ts/src/os/agentos.ts` (`AgentOS`).</p> <p>### Vulnerable code / root cause</p> <p>Path: `src/praisonai-ts/src/os/config.ts`</p> <p>Class/const: `DEFAULT_AGENTOS_CONFIG` / `mergeConfig`</p> <p>Snippet: ```ts export const DEFAULT_AGENTOS_CONFIG = { host: &#39;0.0.0.0&#39;, corsOrigins: [&#39;*&#39;], apiKey: &#39;&#39;, // ... }; // mergeConfig: apiKey = userConfig?.apiKey ?? process.env.PRAISONAI_AGENTOS_API_KEY ?? &#39;&#39;; ``` Issue: defaults bind all interfaces, with an empty API key and wildcard CORS. `apiKey` stays empty unless the developer explicitly sets it.</p> <p>Path: `src/praisonai-ts/src/os/agentos.ts`</p> <p>Function: `serve` / `_registerRoutes` (Express app)</p> <p>Snippet: ```ts if (this.config.apiKey) { // auth middleware ONLY added when apiKey is set app.use((req,res,next) =&gt; { /* 401 unless Bearer…</p> https://cve.radiocsirt.org/vuln/ghsa-6wjp-v33h-5cvq