PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
Date: 2026-05
Affected: pip/PraisonAI
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-44338
CVE-2026-47393
CWE: CWE-1188
CWE-306
CWE-668
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

### Summary CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that: - binds to `0.0.0.0` per the recommended sample YAML - exposes `/chat` and `/agents` endpoints - runs `praisonai.run()` on user-supplied JSON input — LLM orchestration with the API key materials present in the process environment - does not require any authentication The PyPI wheel `praisonai==4.6.33` (current `@latest`) still ships the generator with `auth_enabled` defaulting to `False`. The fix shape is opt-in via `APIConfig(auth_enabled=True, auth_token=...)`. ### Details **Anchor (file:line:symbol)** - Vulnerable artifact: `praisonai==4.6.33` on PyPI. - Defaults: `praisonai/deploy/models.py:29` — `auth_enabled: bool = Field(default=False, ...)`; `praisonai/deploy/models.py:30` — `auth_token: Optional[str] = Field(default=None, ...)`. - Generator: `praisonai/deploy/api.py:40` — `AUTH_ENABLED = {config.auth_enabled}`; `api.py:41` — `AUTH_TOKEN = {repr(config.auth_token)}`; `api.py:43-49` — `def check_auth(): if not AUTH_ENABLED: return True`. - CLI entry: documented as `praisonai deploy --type api` (vendor README); produces the generator output above with no flag required to suppress the warning, because no warning is emitted. **Vulnerable code (verbatim from i


Mitigations:

Architectural layers (MAESTRO):