Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| praisonaiagents | pip | < 1.6.59 | 1.6.59 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the AgentTeam.launch() method (aliased as Agents.launch()) in src/praisonai-agents/praisonaiagents/agents/agents.py. This method starts a FastAPI server that exposes several endpoints for agent interaction. The functions handle_query, list_agents, and handle_single_agent are the handlers for these endpoints. Prior to the fix, these handlers did not perform any authentication checks, allowing any network client to list and invoke agents without credentials. This could lead to unauthorized resource usage, information disclosure, and other security risks depending on the agents' capabilities. The patch introduces the _authorise_launch_request function, which checks for an authentication token in the Authorization or X-Auth-Token headers. This function is now called at the beginning of each of the vulnerable handlers, ensuring that only authorized users can access these endpoints.
Agents.launch.handle_querysrc/praisonai-agents/praisonaiagents/agents/agents.py
Agents.launch.list_agentssrc/praisonai-agents/praisonaiagents/agents/agents.py
Agents.launch.create_agent_handler.handle_single_agentsrc/praisonai-agents/praisonaiagents/agents/agents.py