CVE-2026-55534 in PraisonAI
Summary
by MITRE • 08/25/2026
PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke configured agents without credentials even when an API key was supplied. This issue is fixed in version 4.6.58.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified within PraisonAI versions ranging from 4.6.34 to 4.6.58 represents a critical authentication bypass flaw inherent in the application's agent serving mechanism. PraisonAI operates as a multi-agent team system, designed to orchestrate complex workflows through interconnected artificial intelligence agents. The core issue arises during the initialization of the internal application environment via the _create_agents_app() function. While the command-line interface correctly accepts an API key argument intended to secure access to the service, this credential is not propagated or enforced within the backend logic that handles incoming HTTP requests for agent execution. Consequently, the authentication layer fails to validate the provided credentials against subsequent POST requests directed at endpoints such as /agents and /agents/{agent_name}.
From a technical perspective, this flaw constitutes an improper implementation of authentication controls where the presence of valid API keys is ignored during request processing. An attacker or any network caller with access to the PraisonAI service endpoint can bypass the intended security gate by sending unauthenticated POST requests to create new agents or invoke existing ones. The system processes these requests as if they were authorized, effectively rendering the configured API key obsolete for protecting agent creation and invocation operations. This discrepancy between configuration intent and runtime enforcement allows unauthorized entities to interact with the AI infrastructure without possessing valid credentials.
The operational impact of this vulnerability is significant due to the nature of PraisonAI's functionality. Since agents can be created or invoked remotely, an attacker could potentially instantiate malicious agents designed to perform unintended actions, exfiltrate sensitive data processed by other agents, or consume computational resources for denial-of-service purposes. Furthermore, if these agents have access to external tools or APIs, the lack of authentication could lead to broader security compromises within the connected ecosystem. The ability to spawn arbitrary agents without restriction undermines the integrity and confidentiality guarantees expected from a secured AI service deployment.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically where an actor is able to bypass or manipulate authentication mechanisms. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK technique T1078, Valid Accounts, as it allows unauthorized actors to utilize the system's capabilities by exploiting a failure in credential verification. It also relates to CWE-352, Cross-Site Request Forgery (CSRF), if the application relies on session cookies or other stateful mechanisms that are not properly protected against unauthenticated requests, although the primary issue here is the lack of API key validation rather than request forgery per se.
To mitigate this risk, organizations running PraisonAI must immediately upgrade to version 4.6.58 or later, where the developers have addressed the authentication gap in the _create_agents_app() function. Until an update can be applied, administrators should restrict network access to the PraisonAI service endpoints using firewall rules or reverse proxy configurations that enforce external authentication checks before requests reach the application layer. Additionally, monitoring logs for unusual patterns of agent creation or invocation from unknown IP addresses can help detect potential exploitation attempts in real-time. Ensuring that API keys are strictly validated on all relevant endpoints is essential to maintaining the security posture of multi-agent AI systems.