PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
Priority HIGH 76CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.
Summary
PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke configured agents without credentials even when an API key was supplied. This issue is fixed in version 4.6.58.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00453 39th percentileScored 2026-11-07
Fix Fixed PraisonAI (MervinPraison): 4.6.58PraisonAI (PyPI): 4.6.58
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MervinPraison | PraisonAI | 4.6.34 to before 4.6.58 | 4.6.58 | Patch available | CNA |
| — | PraisonAI (PyPI) | 4.6.34 to before 4.6.58 | 4.6.58 | Patch available | GHSA-7ww9-85pg-cv4x |
- PraisonAI VendorMervinPraison Affected 4.6.34 to before 4.6.58 Fixed in 4.6.58 Patch available CNA
- PraisonAI (PyPI) Vendor— Affected 4.6.34 to before 4.6.58 Fixed in 4.6.58 Patch available GHSA-7ww9-85pg-cv4x
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* | — | — | MervinPraison |
- cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions — — ·MervinPraison
Remediation
- Fix · CNA PraisonAI (MervinPraison) Fixed in 4.6.58
- Fix · GHSA-7ww9-85pg-cv4x PraisonAI (PyPI) Fixed in 4.6.58 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55534
- 2026-10-03 Alias added: GHSA-7ww9-85pg-cv4x
References
More MervinPraison vulnerabilities
- TI-2026-79619 Missing authentication in PraisonAI AgentOS exposes agent chat CVSS 3.1CRITICAL 9.8
- TI-2026-71236 Missing access control in PraisonAI AgentTeam exposes agent endpoints CVSS 3.1CRITICAL 9.8
- TI-2026-44052 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent CVSS 4.0CRITICAL 10.0
- TI-2026-41123 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) CVSS 3.1CRITICAL 9.8
- TI-2026-41122 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery CVSS 3.1CRITICAL 9.8
- TI-2026-41118 PraisonAI MCPServer exposes unauthenticated HTTP tools/call CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-55534 · CVE Program
- CVE-2026-55534 · NVD
- FIRST EPSS
- GHSA-7ww9-85pg-cv4x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences