PatchTheCVECVE-2026-40151: PraisonAI is a multi-agent teams system
CVE-2026-40151 is a medium-severity flaw (CVSS 5.3) affecting praisonai. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no authentication middleware, no API key validation, and defaults to CORS allow_origins=["*"] with host="0.0.0.0", making every deployment network-accessible and quer
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 45%) |
| CISA exploited list | No |
| Weakness | CWE-200 |
| Published | 2026-04-09 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: PraisonAI AgentOS - Information Disclosure
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-40151?
praisonai: upgrade to 4.5.128. Exact commands for each OS are on this page.
Is CVE-2026-40151 being exploited?
CVE-2026-40151 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-40151 affect?
CVE-2026-40151 affects praisonai. Severity is medium (CVSS 5.3). PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated
How urgent is CVE-2026-40151?
Priority 42/100. Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-40288 CRITICAL 9.8 UPGRADE UPGRADE PraisonAI is a multi-agent teams system
- CVE-2026-40289 CRITICAL 9.1 UPGRADE UPGRADE PraisonAI is a multi-agent teams system
- CVE-2026-40315 CRITICAL 9.8 UPGRADE PraisonAI is a multi-agent teams system
- CVE-2026-40116 HIGH 7.5 UPGRADE PraisonAI is a multi-agent teams system
- CVE-2026-40113 HIGH 8.4 UPGRADE PraisonAI is a multi-agent teams system