p PatchFirst

CVE-2026-55534

CVE-2026-55534 · PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke configured agents without credentials even when an API key was supplied. This issue is fixed in version 4.6.58.

CVSS 8.6 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • praisonai

    Versions
    • >= 4.6.34, < 4.6.58: Affected

    No fix published

  • praisonai PyPI

    Versions
    • 4.6.34
    • 4.6.35
    • 4.6.36
    • 4.6.37
    • 4.6.38
    • 4.6.39
    • 4.6.40
    • 4.6.41
    • 4.6.42
    • 4.6.43
    • 4.6.44
    • 4.6.45
    • 4.6.46
    • 4.6.47
    • 4.6.48
    • 4.6.50
    • 4.6.51
    • 4.6.52
    • 4.6.53
    • 4.6.54
    • 4.6.55
    • 4.6.56
    • 4.6.57
    Affected ranges
    • ECOSYSTEM: ≥ 4.6.34, < 4.6.58

    Update to 4.6.58

Original sources

Check your server →