Executive brief
PraisonAI is an agent orchestration framework that can expose AI agents via a network API server. When operators configure the `--api-key` flag to authenticate production deployments, the key is accepted but not enforced on the agent invocation endpoints. Any network-reachable attacker can invoke configured agents without credentials, leading to unauthorized LLM usage, cost consumption, workflow execution, and potential data exposure through connected tools.
Technical details
The vulnerability is an authentication bypass in FastAPI route handlers for the `serve agents` subcommand. The CLI accepts and stores the `--api-key` parameter in the configuration passed to `_create_agents_app()`, but the function fails to instantiate a FastAPI auth dependency or middleware to validate the key on request. The `POST {path}` and `POST /agents/{agent_name}` routes are registered without any authentication requirements and directly invoke configured agents. A coexisting protected route (`/api/v1/agents/{agent_id}/invoke`) uses a separate `CALL_SERVER_TOKEN` mechanism, showing the authentication infrastructure is available elsewhere but not applied to the compatibility routes. Attack requires only network reachability to the server; no privileged access or user interaction is needed. The fix requires deriving an auth dependency from the config, applying it to both affected routes, and using constant-time key comparison.
Affected products
- MervinPraison PraisonAI >= 4.6.34, < 4.6.58
Timeline
- 2026-06-13: disclosed: Published to GitHub Advisory Database
- 2026-08-25: advisory: Indexed in GitHub Advisory Database
- 2026-06-13: patched: Patched in version 4.6.58