PT-2026-81330 · Praisonai · Praisonai

Saisathvik1

·

CVE-2026-55541

·

Published

2026-08-25

·

Updated

2026-09-10

CVSS v4.0

8.8

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58
Description In the serve subsystem, the praisonai serve agents and praisonai serve unified commands accept an --api-key flag for authentication, but the parsed value is not implemented within the FastAPI application. Consequently, the create agents app() and create unified app() functions fail to install a credential check, leaving the server open to unauthenticated access regardless of the key provided. This allows unauthorized callers to trigger agent workflows, potentially leading to API quota exhaustion or unauthorized tool and code execution depending on the agent configuration.
API Endpoints:
  • POST /agents
  • POST /agents/{name}
  • POST /api/v1/agents/{id}/invoke
  • GET /
  • GET / praisonai /discovery
Vulnerable Parameters or Variables:
  • api key
Recommendations Update PraisonAI to version 4.6.58 or later.

Exploit

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-55541
GHSA-PVXX-R596-F5QJ
PYSEC-2026-3893

Affected Products

Praisonai