GHSA-6wjp-v33h-5cvq PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

• npm praisonai: < 1.7.3 → fixed in 1.7.3

Summary The AgentOS server in the `praisonai` TypeScript/npm package ships an insecure default: it binds `0.0.0.0`, sets no API key, and uses CORS `*` with credentials. The API-key middleware is only registered when an API key is configured, so the documented quickstart (`new AgentOS({agents:[...]}).serve({port})`) exposes, unauthenticated, `GET /api/agents` (which leaks agent names/roles/instructions, i.e. system prompts) and `POST /api/chat` (which invokes agents). Any network peer can read agent system prompts and drive the agent. Runtime-confirmed; severity High. Details Affected component • Package: `praisonai` (npm / TypeScript). Files `src/praisonai-ts/src/os/config.ts` and `src/praisonai-ts/src/os/agentos.ts` (`AgentOS`). Vulnerable code / root cause Path: `src/praisonai-ts/src/os/config.ts` Class/const: `DEFAULT_AGENTOS_CONFIG` / `mergeConfig` Snippet: ```ts export const DEFAULT_AGENTOS_CONFIG = { host: '0.0.0.0', corsOrigins: ['*'], apiKey: '', // ... }; // mergeConfig: apiKey = userConfig?.apiKey ?? process.env.PRAISONAI_AGENTOS_API_KEY ?? ''; ``` Issue: defaults bind all interfaces, with an empty API key and wildcard CORS. `apiKey` stays empty unless the developer explicitly sets it. Path: `src/praisonai-ts/src/os/agentos.ts` Function: `serve` / `_registerRoutes` (Express app) Snippet: ```ts if (this.config.apiKey) { // auth middleware ONLY added when apiKey is set app.use((req,res,next) => { /* 401 unless Bearer/x-auth-token matches */ }); } // routes: app.get(`${apiPrefix}/agents`, ...) // returns name/role/instructions app.post(`${apiPrefix}/chat`, ...) // calls agent.chat(message) ``` Issue: the only auth gate is conditional on a non-empty `apiKey`. With the default empty key, no auth middleware is registered, and `GET /api/agents` (system-prompt disclosure) and `POST /api/chat` (agent invocation) are served to any network client. CORS sets `Access-Control-Allow-Credentials: true` with a wildcard origin. Attack flow 1. Developer deploys AgentOS via the quickstart without setting `apiKey`/`PRAISONAI_AGENTOS_API_KEY`. 2. Any network peer calls `GET /api/agents` → receives agent instructions/system prompts. 3. Any network peer calls `POST /api/chat` → invokes the agent. Why existing protection is bypassed There is no protection in the default config — the auth gate is skipped when `apiKey` is empty (the default), and the server binds all interfaces. Security boundary Unauthenticated network access to agent metadata + invocation. This is the CVE-2026-44338 anti-pattern recurring in the TS package, and worse (0.0.0.0 is the default). Proof of Concept Environment Real AgentOS from `src/praisonai-ts` run via ts-node in a node container with default config (stub agent, no LLM needed). `127.0.0.1:18000`. Runnable assets: `PraisonAI-Runtime-Repro\runtime-files\` (`docker-compose.agentos.yml`). Steps to reproduce 1. `PRAI-01-01-AgentOS-Agents-NoAuth`: `GET /api/agents` (no Authorization) → `127.0.0.1:18000`. 2. `PRAI-01-02-AgentOS-Chat-NoAuth`: `POST /api/chat {"message":"hello from attacker"}` (no Authorization). Expected result Non-loopback exposure should require authentication; agent instructions should not be disclosed unauthenticated. Actual result • `GET /api/agents` → `200`, leaks `"instructions":"SYSTEM PROMPT SECRET ... PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91"`; response header `Access-Control-Allow-Credentials: true`. • `POST /api/chat` → `200`, agent invoked (`"response":"...PRAISONAI_AGENTOS_CANARY_7f3a91..."`). Screenshots Unauthenticated `/api/agents` leaks agent instructions A GET request to `/api/agents` succeeds without an `Authorization` header. The response exposes agent metadata and instructions, including the canary system-prompt value. Unauthenticated `/api/chat` invokes the agent A POST request to `/api/chat` succeeds without an `Authorization` header. The response confirms that the attacker-controlled message was processed by the configured agent. Reproduction assets The attached archive contains the local Docker runtime used to reproduce the issue with controlled canary values only. It does not contain real secrets, third-party API keys, or production credentials. PraisonAI-Runtime-Repro.zip Impact Unauthenticated disclosure of agent configuration/system prompts; unauthenticated agent invocation; LLM cost abuse; possible tool abuse depending on the configured agent's tools; permissive CORS-with-credentials. Suggested remediation • Default `host` to `127.0.0.1`; require `apiKey` (fail closed) when binding non-loopback. • Do not default `corsOrigins` to `['*']`, especially with `Access-Control-Allow-Credentials: true`. • Do not return full `instructions` on an unauthenticated endpoint.