{"id":"CVE-2026-61426","title":"PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS","summary":"PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompt…","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cwe":["CWE-200"],"published":"2026-07-11","updated":"2026-07-11","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61426","references":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6wjp-v33h-5cvq","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/praisonai-before-unauthenticated-agent-access-via-insecure-defaults","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"ingestedAt":"2026-07-11T23:16:21.116Z","epss":0.00478,"epssPercentile":0.40427,"slug":"CVE-2026-61426","body":"## Overview\n\nPraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}