PT-2026-81323 · Praisonai · Praisonai

Huslayer826

·

CVE-2026-55534

·

Published

2026-08-25

·

Updated

2026-09-10

CVSS v3.1

8.6

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.6.34 through 4.6.57
Description In the praisonai serve agents command, the system fails to enforce authentication on public agent invocation endpoints even when an API key is provided via the --api-key flag. The create agents app() function does not utilize the configured API key to implement middleware or authentication dependencies for specific routes. Consequently, a network-reachable caller can invoke configured agents without providing any credentials, such as an Authorization header or X-API-Key.
API Endpoints:
  • POST /agents
  • POST /agents/{agent name}
Vulnerable Parameters or Variables:
  • api key
Function Names:
  • create agents app()
Recommendations Update PraisonAI to version 4.6.58. As a temporary workaround, restrict network access to the server to prevent unauthorized external callers from reaching the affected API endpoints.

Exploit

Fix

Missing Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-55534
GHSA-7WW9-85PG-CV4X
PYSEC-2026-3887

Affected Products

Praisonai