Summary
CVE-2026-55534 is a missing-authentication vulnerability (CWE-306) in PraisonAI, an open-source multi-agent AI framework. The serve agents CLI command accepts an --api-key parameter intended to protect the exposed HTTP server, but the underlying _create_agents_app() function fails to enforce this authentication on the /agents and /agents/{agent_name} POST endpoints. As a result, a remote, unauthenticated attacker can invoke and execute configured agents even when an API key was explicitly configured, giving the issue a HIGH severity rating of 8.6.
Technical details
- Root cause: The
_create_agents_app()function, which builds the FastAPI/HTTP application served bypraisonai serve agents, does not apply the API key check to the POST handlers for/agentsand/agents/{agent_name}, even though the--api-keyflag is documented and accepted by the CLI. - Trigger conditions: An operator runs
praisonai serve agentswith--api-keyset, believing the endpoint is protected, and exposes the service to a network (including the internet). - Attack vector: Network-based (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N) — an attacker simply sends unauthenticated POST requests to the exposed agent endpoints.
- Impact: Unauthorized invocation and execution of any agent configured on the server. Depending on what the configured agents are capable of (e.g., shell/tool access, file operations, external API calls), this can lead to data exposure, unauthorized actions being taken on the attacker’s behalf, and resource exhaustion — reflected in the CVSS impact subscores of Confidentiality: Low, Integrity: Low, Availability: High.
Affected software
- Product: PraisonAI (MervinPraison/PraisonAI)
- Vulnerable versions: 4.6.34 through 4.6.57 (inclusive)
- Fixed version: 4.6.58
Severity
- CVSS v3.1 Base Score: 8.6 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Mitigation and recommended actions
- Immediate: Upgrade PraisonAI to version 4.6.58 or later, which corrects the authentication enforcement in
_create_agents_app()so the--api-keyparameter is properly validated on the/agentsand/agents/{agent_name}endpoints. - If immediate patching is not possible:
- Do not expose the
praisonai serve agentsendpoint directly to untrusted networks or the public internet; restrict access to trusted internal networks only. - Place the service behind a reverse proxy or API gateway that enforces its own authentication/authorization independent of the application’s built-in
--api-keycheck. - Use network-level controls (firewall rules, security groups, VPN-only access) to limit which hosts can reach the
/agentsendpoints. - Monitor logs for unexpected or unauthenticated POST requests to
/agentsand/agents/{agent_name}as an indicator of exploitation attempts.
- Do not expose the

