What is GHSA-g3pq-3vvx-36w6?

GHSA-g3pq-3vvx-36w6 is a security advisory published by GitHub Security Advisories with High severity. PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces...

Which CVE IDs does GHSA-g3pq-3vvx-36w6 cover?

GHSA-g3pq-3vvx-36w6 covers the following CVE IDs: CVE-2026-61426. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g3pq-3vvx-36w6?

GHSA-g3pq-3vvx-36w6 has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

GHSA-g3pq-3vvx-36w6HighCVSS 8.6

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces...

Vendor

GitHub Security Advisories

Published

July 11, 2026

Last Modified

July 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-61426 →

📋 Description

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.

🔗 References (4)

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6wjp-v33h-5cvq
https://nvd.nist.gov/vuln/detail/CVE-2026-61426
https://www.vulncheck.com/advisories/praisonai-before-unauthenticated-agent-access-via-insecure-defaults
https://github.com/advisories/GHSA-g3pq-3vvx-36w6