Huslayer826

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions 4.6.34 through 4.6.57 **Description** In the `praisonai serve agents` command, the system fails to enforce authentication on public agent invocation endpoints even when an API key is provided via the `--api-key` flag. The ` create agents app()` function does not utilize the configured API key to implement middleware or authentication dependencies for specific routes. Consequently, a network-reachable caller can invoke configured agents without providing any credentials, such as an `Authorization` header or `X-API-Key`. **API Endpoints:** - `POST /agents` - `POST /agents/{agent name}` **Vulnerable Parameters or Variables:** - `api key` **Function Names:** - ` create agents app()` **Recommendations** Update PraisonAI to version 4.6.58. As a temporary workaround, restrict network access to the server to prevent unauthorized external callers from reaching the affected API endpoints.