Is CVE-2026-40115 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-40115, but active exploitation has not been confirmed.

Can CVE-2026-40115 be exploited remotely?

No. CVE-2026-40115 requires local access to exploit.

What is the CVSS score of CVE-2026-40115?

CVE-2026-40115 has a CVSS score of 6.2 (MEDIUM).

HOME VULNERABILITIESCVE-2026-40115

MEDIUMPOC

CVE-2026-40115

CWE-770Published: April 9, 2026· Updated: Apr 13, 2026

6.2

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.4th

Official Description

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the WSGI-based recipe registry server (server.py) reads the entire HTTP request body into memory based on the client-supplied Content-Length header with no upper bound. Combined with authentication being disabled by default (no token configured), any local process can send arbitrarily large POST requests to exhaust server memory and cause a denial of service. The Starlette-based server (serve.py) has RequestSizeLimitMiddleware with a 10MB limit, but the WSGI server lacks any equivalent protection. This vulnerability is fixed in 4.5.128.

NVD Source

Technical Analysis

CVE-2026-40115 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 6.2.

A proof-of-concept (PoC) exploit exists for CVE-2026-40115. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.