PraisonAI-Style Auth-Disabled-By-Default Configuration (CVE-2026-44338 family) - ATR-2026-00528 (b079072d-bb06-56de-b354-7763d27687cb)
Detects the configuration shape exploited by CVE-2026-44338 (PraisonAI authentication bypass, disclosed 2026-05-18, Sysdig wave-analysis showed internet-exposed instances were scanned within 3 hours 44 minutes of disclosure). The PraisonAI legacy Flask server shipped with AUTH_ENABLED = False and AUTH_TOKEN = None hard-coded as defaults, leaving /agents and /chat endpoints unauthenticated when deployed without operator override. Affects versions 2.5.6 through 4.6.33. The detection target is the static configuration pattern — agent framework code that ships authentication-disabling defaults — which generalizes beyond PraisonAI to any agent server that takes this shortcut.