Executive brief
PraisonAI is an AI agent orchestration platform that exposes HTTP endpoints to invoke registered agents. When operators start the service with the `--api-key` flag, they expect it to require authentication on all agent invocation endpoints. However, the implementation parses the flag but never actually enforces it, leaving the two primary agent-invocation routes unguarded. An attacker on the network can invoke any agent without credentials, potentially accessing LLM provider credentials, RAG data, browser tools, or shell access that the agent holds.
Technical details
The vulnerability is an authentication bypass caused by incomplete implementation. The CLI in `cli/commands/serve.py` accepts the `--api-key` parameter and forwards it to `ServeHandler`, which parses it into a config dict. However, the `_create_agents_app()` function in `cli/features/serve.py` never reads `config["api_key"]` and installs no auth middleware or dependency on the direct agent routes (`POST /agents`, `POST /agents/{agent_name}`). In stark contrast, a working `verify_token` dependency exists in the same codebase and properly guards the `/api/v1/...` routes (returning HTTP 401 on missing/invalid credentials), but it reads from the `CALL_SERVER_TOKEN` environment variable rather than the CLI flag, creating a broken auth path. The routes have no auth validation: any request with no credentials, invalid Bearer token, invalid X-API-Key header, or empty bearer token reaches `agent.start()` and executes successfully. Patch version 4.6.58 addresses this by applying proper auth dependencies to the direct agent routes.
Affected products
- PraisonAI PraisonAI < 4.6.58
Timeline
- 2026-06-13: disclosed: Disclosed on GitHub Advisory Database
- 2026-08-25: patched: Patched in version 4.6.58 (as of advisory update date)