GHSA-892r-p3jq-jp24: PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation Summary PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The public AgentOS advisory is published as an instruction-disclosure issue with affected versions < 4.5.128 and patched version 4.5.128. However, v4.5.128, latest release v4.6.57, and current main still register GET /api/agents and POST /api/chat without authentication. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. Affected Product - Repository: MervinPraison/PraisonAI - Package: praisonai - Component: src/praisonai/praisonai/app/agentos.py - Config component: src/praisonai-agents/praisonaiagents/app/config.py - Public advisory incomplete-fix reference: GHSA-pm96-6xpr-978x / CVE-2026-40151 Confirmed affected dynamically: - v4.5.126 - v4.5.128 (published patched version for GHSA-pm96-6xpr-978x) - v4.6.9 - v4.6.10 - v4.6.56 - v4.6.57 - current main 2f9677abb2ea68eab864ee8b6a828fd0141612e1 Static source review found the same unauthenticated route pattern and 0.0.0.0 default in v4.2.1. Suggested affected range: >= 4.2.1, <= 4.6.57. Root Cause AgentOSConfig / AgentAppConfig defaults the deployment host to all interfaces and has no authentication fields: name: str = "PraisonAI App" host: str = "0.0.0.0" port: int = 8000 api_prefix: str = "/api" AgentOS._register_routes() registers public agent metadata and chat routes without middleware, dependency, API key check, bearer-token check, or startup fail-closed guard: @app.get(f"{self.config.api_prefix}/agents") asy