CVE-2026-44338 POC (Proof-of-Concept)

PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the configured agents.yaml workflow through /chat without providing a token. This issue has been patched in version 4.6.34.

Published: 2026-05-08

CVSS: 7.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Download CVE-2026-44338 POC (Proof-of-Concept) here:

Tip: Download official Tor Browser at https://www.torproject.org/download/ to access .onion links.

https://hokyo.gr/poc-545-cve-2026-20034/

https://hokyo.gr/poc-206-cve-2026-42366/

https://hokyo.gr/poc-880-cve-2026-44336/

https://hokyo.gr/poc-425-cve-2026-7856/

https://hokyo.gr/poc-455-cve-2026-43093/