Vulnerability · Published Aug 25, 2026 · Assigned by GitHub_M

CVE-2026-55541PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

High 8.8

In plain English

A high-severity missing authorization in PraisonAI from MervinPraison. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.5%top 58.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app() and _create_unified_app() do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/{id}/invoke. This issue is fixed in version 4.6.58.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	praisonai	4.6.58	GHSA-pvxx-r596-f5qj
PyPI	praisonai	4.6.58	PYSEC-2026-3893

Affected products (as reported)

Vendor	Product	Versions
MervinPraison	PraisonAI	< 4.6.58

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pvxx-r596-f5qj x_refsource_CONFIRM
https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1 x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58 x_refsource_MISC