AI Threat AlertCVE-2026-55534: PraisonAI: API key ignored, agent endpoints unauth
GHSA-7ww9-85pg-cv4xHIGHCISA: TRACK*PraisonAI's `serve` command accepts an --api-key flag as if it protects the agent HTTP API, but `_create_agents_app()` never enforces that key on POST /agents or POST /agents/{agent_name} — any network caller can invoke configured agents with zero credentials, even when an API key was supplied. This is a CVSS 8.6 vulnerability requiring only network access, no privileges, and no user interaction (CWE-306, Missing Authentication for Critical Function), meaning anyone who can reach the exposed port can trigger whatever tools, integrations, or downstream actions the agent has access to, with confirmed confidentiality and integrity impact plus high availability impact from potential agent abuse or resource exhaustion. There is no CISA KEV listing, no public exploit, and no Nuclei scanner template yet, and EPSS data isn't published, so this reads as a fresh disclosure rather than something under active exploitation today — but the false sense of security from a seemingly configured --api-key makes silent exposure especially likely, and the low downstream dependent count (1) somewhat caps current blast radius. Patch to praisonai >= 4.6.58 immediately on any deployment where `praisonai serve` is reachable from an untrusted network, and until patched, place these endpoints behind a reverse proxy or firewall/ACL enforcing real authentication rather than relying on the app's own flag; monitor for POST /agents or /agents/{name} calls lacking valid credentials as a detection signal.
What is the risk?
High severity (CVSS 8.6) with low exploit complexity and no authentication or user interaction required — a textbook trivially-exploitable auth bypass. Confidentiality and integrity impact are limited (C:L/I:L) but availability impact is high (A:H), reflecting the risk that an unauthenticated caller can drive agent behavior, consume compute/API budget, or trigger destructive tool actions. No evidence of active exploitation (not in CISA KEV, no public PoC, no Nuclei template, EPSS unavailable), so this is currently a disclosure-stage risk rather than an in-the-wild threat, but the trivial exploitation path (a single unauthenticated HTTP POST) means risk will rise quickly once a PoC circulates. Exposure is entirely dependent on whether operators expose `praisonai serve` beyond localhost/trusted networks — internet-facing or shared-network deployments are the primary concern.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | >= 4.6.34, < 4.6.58 | 4.6.58 |
Do you use PraisonAI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade praisonai to >= 4.6.58 immediately, which fixes the missing authentication check. 2) Until patched, do not expose
praisonai servedirectly to untrusted networks — bind to localhost or place it behind a reverse proxy (nginx/Caddy) or API gateway that enforces authentication independently of the app's --api-key flag. 3) Use network-level controls (firewall rules, security groups, VPC/private networking) to restrict access to the serve port to trusted callers only. 4) After patching, verify the fix by attempting an unauthenticated POST /agents call and confirming it is rejected. 5) Audit logs/proxy access logs for POST /agents or /agents/{agent_name} requests without valid API key headers as a retrospective compromise indicator. 6) Review what tools/credentials each served agent has access to and rotate any credentials that may have been reachable during the exposure window.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-55534?
PraisonAI's `serve` command accepts an --api-key flag as if it protects the agent HTTP API, but `_create_agents_app()` never enforces that key on POST /agents or POST /agents/{agent_name} — any network caller can invoke configured agents with zero credentials, even when an API key was supplied. This is a CVSS 8.6 vulnerability requiring only network access, no privileges, and no user interaction (CWE-306, Missing Authentication for Critical Function), meaning anyone who can reach the exposed port can trigger whatever tools, integrations, or downstream actions the agent has access to, with confirmed confidentiality and integrity impact plus high availability impact from potential agent abuse or resource exhaustion. There is no CISA KEV listing, no public exploit, and no Nuclei scanner template yet, and EPSS data isn't published, so this reads as a fresh disclosure rather than something under active exploitation today — but the false sense of security from a seemingly configured --api-key makes silent exposure especially likely, and the low downstream dependent count (1) somewhat caps current blast radius. Patch to praisonai >= 4.6.58 immediately on any deployment where `praisonai serve` is reachable from an untrusted network, and until patched, place these endpoints behind a reverse proxy or firewall/ACL enforcing real authentication rather than relying on the app's own flag; monitor for POST /agents or /agents/{name} calls lacking valid credentials as a detection signal.
Is CVE-2026-55534 actively exploited?
No confirmed active exploitation of CVE-2026-55534 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-55534?
1) Upgrade praisonai to >= 4.6.58 immediately, which fixes the missing authentication check. 2) Until patched, do not expose `praisonai serve` directly to untrusted networks — bind to localhost or place it behind a reverse proxy (nginx/Caddy) or API gateway that enforces authentication independently of the app's --api-key flag. 3) Use network-level controls (firewall rules, security groups, VPC/private networking) to restrict access to the serve port to trusted callers only. 4) After patching, verify the fix by attempting an unauthenticated POST /agents call and confirming it is rejected. 5) Audit logs/proxy access logs for POST /agents or /agents/{agent_name} requests without valid API key headers as a retrospective compromise indicator. 6) Review what tools/credentials each served agent has access to and rotate any credentials that may have been reachable during the exposure window.
What systems are affected by CVE-2026-55534?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, API-exposed agent serving.
What is the CVSS score for CVE-2026-55534?
CVE-2026-55534 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.45%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationAML.T0108AI AgentCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke configured agents without credentials even when an API key was supplied. This issue is fixed in version 4.6.58.
Exploitation Scenario
An adversary scans for exposed PraisonAI serve instances (e.g., via Shodan/Censys or internal network reconnaissance) and identifies a host running `praisonai serve --api-key <key>` on an accessible port. Believing the endpoint is protected, the operator has not added additional network-level authentication. The adversary sends a POST request to /agents or /agents/{agent_name} with no credentials at all, and the request succeeds because `_create_agents_app()` never validates the API key. The adversary can now invoke any configured agent, potentially triggering the agent's tool integrations (e.g., file access, external API calls, database queries) to exfiltrate data, pivot to connected systems, or exhaust compute/API quota — all without ever needing valid credentials.
Weaknesses (CWE)
CWE-306Missing Authentication for Critical FunctionPrimaryCWE-306Missing Authentication for Critical FunctionPrimaryCWE-306Missing Authentication for Critical FunctionCWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- [Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-4816810.0PraisonAI: shell injection in Claude Action enables RCE
Same package: praisonaiCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiCVE-2026-614459.9PraisonAI: AICoder root RCE via unsanitized tool calls
Same package: praisonaiGHSA-vmmj-pfw7-fjwp9.9praisonai: sandbox escape gives RCE via codeMode tool
Same package: praisonaiCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonai