PT-2026-81328

CVE-2026-55538

Published

2026-08-25

Updated

2026-09-10

Description by

CVSS 3.1

7.3

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58

Description An authentication bypass exists in the multi-agent teams system where the create agents app() function fails to authenticate requests to the 'POST /agents' and 'POST /agents/{agent name}' endpoints. Consequently, requests with missing or incorrect bearer tokens and X-API-Key values can still trigger agent execution.

Recommendations Update to version 4.6.58.

Exploitability

Exploit

Fix

Impacts

Researchers

Riodrwn

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function

Related identifiers