What’s Vulnerable › Vulnerabilities

CVE-2026-55534: PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-25 · updated 2026-09-09
• Weakness: CWE-306

Description

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke configured agents without credentials even when an API key was supplied. This issue is fixed in version 4.6.58.

Affected products

• MervinPraison PraisonAI: from 4.6.34, < 4.6.58

References

• https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
• https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7ww9-85pg-cv4x
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7ww9-85pg-cv4x

Get alerted when CVE-2026-55534 or the next vulnerability affects your stack