Summary
PraisonAI agent-team endpoints can be exposed without authentication or authorization checks, allowing unauthenticated clients to enumerate agents and invoke agent conversations. When the server is remotely reachable, this may consume model resources, expose connected private context, and trigger tools or workflow side effects.
PraisonAI agent-team endpoints can be exposed without authentication or authorization checks, allowing unauthenticated clients to enumerate agents and invoke agent conversations. When the server is remotely reachable, this may consume model resources, expose connected private context, and trigger tools or workflow side effects.
Affected context
The issue occurs in PraisonAI deployments using the affected agent-team interfaces, including the AgentTeam.launch flow or its Agents alias, when those interfaces are exposed through a remotely reachable server. Risk is higher when endpoint access is not placed behind authentication and authorization controls, particularly if agents can access private data, paid model services, external tools, or state-changing workflows.
The issue occurs in PraisonAI deployments using the affected agent-team interfaces, including the AgentTeam.launch flow or its Agents alias, when those interfaces are exposed through a remotely reachable server. Risk is higher when endpoint access is not placed behind authentication and authorization controls, particularly if agents can access private data, paid model services, external tools, or state-changing workflows.
Exploit preconditions
- Attack surface: HTTP endpoints registered for agent listing and invocation
- Required access: Network reachability; no valid credentials may be required
- Trigger point: Requests to the agent-listing or agent-chat routes
- Why exploitation is possible: The routes are registered without effective authentication and authorization checks before agent enumeration or chat execution
- Attack surface: HTTP endpoints registered for agent listing and invocation
- Required access: Network reachability; no valid credentials may be required
- Trigger point: Requests to the agent-listing or agent-chat routes
- Why exploitation is possible: The routes are registered without effective authentication and authorization checks before agent enumeration or chat execution
Why this happens
The underlying defect is an access-control design failure in which sensitive agent operations are exposed before the application verifies the caller's identity and permissions. Missing authentication maps to CWE-306, while the absence of authorization enforcement for protected agent resources and actions maps to CWE-862. The insecure pattern is registering operational endpoints without applying a consistent security boundary to every route and action.
The underlying defect is an access-control design failure in which sensitive agent operations are exposed before the application verifies the caller's identity and permissions. Missing authentication maps to CWE-306, while the absence of authorization enforcement for protected agent resources and actions maps to CWE-862. The insecure pattern is registering operational endpoints without applying a consistent security boundary to every route and action.
Potential impact
- Unauthenticated clients may enumerate configured agents
- Attackers could invoke agent conversations and consume model resources
- Private context connected to agents may be disclosed
- Agent tools may be triggered without user authorization
- External systems or workflows may be altered through agent side effects
- Excessive requests could cause service degradation or unexpected costs
- Unauthenticated clients may enumerate configured agents
- Attackers could invoke agent conversations and consume model resources
- Private context connected to agents may be disclosed
- Agent tools may be triggered without user authorization
- External systems or workflows may be altered through agent side effects
- Excessive requests could cause service degradation or unexpected costs
General mitigation guidance
Mitigation generally focuses on making authentication and authorization
mandatory for every agent-management and agent-invocation endpoint.
Common defensive patterns include:
- Require strong authentication before exposing agent routes
- Enforce per-agent and per-action authorization on the server side
- Apply deny-by-default policy for listing, chat, tool use, and workflow execution
- Avoid exposing administrative or agent endpoints directly to untrusted networks
- Use separate identities and least-privilege permissions for tools and connected data
- Reduce input and context trust by constraining accessible data sources and capabilities
- Add rate limits, quotas, auditing, and approval gates for costly or state-changing actions
- Ensure security middleware covers aliases, dynamically registered routes, and alternate request paths
Mitigation generally focuses on making authentication and authorization
mandatory for every agent-management and agent-invocation endpoint.
Common defensive patterns include:
- Require strong authentication before exposing agent routes
- Enforce per-agent and per-action authorization on the server side
- Apply deny-by-default policy for listing, chat, tool use, and workflow execution
- Avoid exposing administrative or agent endpoints directly to untrusted networks
- Use separate identities and least-privilege permissions for tools and connected data
- Reduce input and context trust by constraining accessible data sources and capabilities
- Add rate limits, quotas, auditing, and approval gates for costly or state-changing actions
- Ensure security middleware covers aliases, dynamically registered routes, and alternate request paths
How teams detect issues like this
High-level detection can combine application review, automated testing, and
runtime monitoring.
- Use static analysis to identify route registration without authentication or authorization middleware
- Review whether every agent-listing, chat, tool, and workflow endpoint has an explicit access policy
- Test unauthenticated and under-privileged requests against all route aliases and dynamically created paths
- Monitor logs for anonymous agent enumeration, repeated chat requests, unusual tool invocation, and unexpected resource consumption
- Enforce API gateway policies requiring identity, scopes, quotas, and audit logging
- Add CI checks or automated security review tools that flag publicly reachable agent operations lacking access-control enforcement
High-level detection can combine application review, automated testing, and
runtime monitoring.
- Use static analysis to identify route registration without authentication or authorization middleware
- Review whether every agent-listing, chat, tool, and workflow endpoint has an explicit access policy
- Test unauthenticated and under-privileged requests against all route aliases and dynamically created paths
- Monitor logs for anonymous agent enumeration, repeated chat requests, unusual tool invocation, and unexpected resource consumption
- Enforce API gateway policies requiring identity, scopes, quotas, and audit logging
- Add CI checks or automated security review tools that flag publicly reachable agent operations lacking access-control enforcement
