무슨 일이 있었나
PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated on current main and in releases after the published patch for the earlier GHSA-pm96 / CVE-2026-40151 (an instruction-disclosure issue fixed in 4.5.128). Both /api/agents and /api/chat register without auth and ignore the Authorization header, so unauthenticated and wrong-bearer requests both execute the deployed agent — broader than passive metadata disclosure because it drives the agent itself. Suggested CVSS 9.8.
왜 중요한가
A production multi-agent surface that defaults to all-interfaces binding with no auth means any reachable client can invoke agents carrying tools, private context, memory and API integrations. This is unauthenticated agent control — the highest-impact class of agent-framework flaw.
공격 경로
The AgentOS route registrar exposes GET /api/agents and POST /api/chat with no authentication middleware, API key check, or bearer-token validation. The chat route directly calls agent.chat(request.message), and a wrong/absent Authorization header is ignored. A remote unauthenticated client can reach the agent and trigger downstream tools, private-context reads, memory accesses, browser actions and API integrations, and burn model/API budget.
영향받는 시스템
PraisonAI 4.2.1 to before 4.6.59 (AgentOS / AgentApp FastAPI deployment surface; v4.6.57 and current main still affected)
완화 방안
No fully-fixed public release for the AgentOS surface as of this report; the maintainers shipped fixes through 4.6.58/4.6.61 for other advisories but AgentOS remains exposed on main. Immediate control: never expose AgentOS on a reachable interface without an authenticating front proxy (reverse proxy with enforced bearer auth), and bind to 127.0.0.1 until a genuine fix lands. Advisory GHSA-892r-p3jq-jp24.