CVE-2026-55541 in PraisonAI
Summary
by MITRE • 08/25/2026
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app() and _create_unified_app() do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/{id}/invoke. This issue is fixed in version 4.6.58.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in PraisonAI versions prior to 4.6.58 represents a critical authentication bypass within the application's API infrastructure, specifically affecting the endpoints responsible for agent creation and execution. PraisonAI operates as a multi-agent team system where various AI agents collaborate to perform complex tasks. The core of this security flaw lies in the internal functions _create_agents_app() and _create_unified_app(), which are responsible for initializing the application's API routes. These initialization routines failed to implement mandatory credential verification middleware or authentication checks before exposing sensitive endpoints to incoming requests. Consequently, any unauthenticated actor on the network could interact directly with these services without providing valid API keys or session tokens, effectively rendering the security boundary of the application non-existent for specific high-privilege operations.
The operational impact of this vulnerability is severe due to the nature of the exposed endpoints POST /agents and POST /api/v1/agents/{id}/invoke. The ability to create new agents unauthenticated allows an attacker to inject malicious agent configurations into the system, potentially altering the behavior of the multi-agent team or consuming significant computational resources through resource exhaustion attacks. More critically, the invocation endpoint enables remote code execution-like capabilities depending on how the invoked agents process input data. An attacker could exploit this to execute arbitrary commands, exfiltrate sensitive data processed by the AI models, or manipulate the logic flow of ongoing agent collaborations. This lack of access control fundamentally undermines the integrity and confidentiality guarantees expected from a secure API service, allowing for unauthorized manipulation of the system's state and outputs.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, as the application failed to verify the identity of users attempting to perform privileged actions. It also maps closely to CWE-306, Missing Authentication for Critical Function, because specific critical functions related to agent management and execution were accessible without any form of credential validation. In terms of adversary tactics, this flaw facilitates Initial Access via API endpoints as described in the MITRE ATT&CK framework under techniques such as T1190 Exploit Public-Facing Application or potentially T1505 Server Software Component if the agents are used to deploy further malicious components. The absence of authentication allows for automated exploitation tools to easily target these endpoints, increasing the risk of widespread compromise in environments where PraisonAI is deployed publicly or on accessible internal networks.
To mitigate this vulnerability and prevent similar issues in future deployments, it is imperative that all API endpoints handling sensitive operations enforce strict authentication mechanisms before processing requests. Developers should implement robust middleware that validates API keys, JWT tokens, or other credential types for every incoming request to the /agents and invocation routes. Additionally, implementing rate limiting can help mitigate potential denial-of-service attempts resulting from unauthenticated abuse of these resources. Organizations currently running versions prior to 4.6.58 must upgrade immediately to the patched version where this authentication gap has been closed. For systems that cannot be upgraded instantly, network-level controls such as firewalls or API gateways should be configured to restrict access to these specific endpoints only from trusted IP addresses or require external proxy-based authentication until a permanent fix is applied. Regular security audits and static code analysis focused on middleware configuration are recommended to ensure no other endpoints suffer from similar oversights in the application lifecycle.