Executive brief
PraisonAI's `praisonai serve` command is a web server that executes AI agent workflows based on API requests. Although users can set an `--api-key` flag to protect the server, the key is parsed but never actually enforced—the server accepts requests from anyone without authentication. An attacker on the network can trigger arbitrary agent workflows, potentially causing data exfiltration, unauthorized LLM API consumption, or execution of embedded tools without any credentials.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the FastAPI app initialization functions `_create_agents_app()` and `_create_unified_app()` in `src/praisonai/praisonai/cli/features/serve.py`. The CLI argument parser accepts `--api-key` and passes the value in the configuration dict, but the application functions never read or use `config["api_key"]`. No FastAPI dependency or middleware is installed to validate the `Authorization: Bearer` header. This affects all exposed endpoints including `POST /agents`, `POST /agents/{name}`, and `GET /__praisonai__/discovery`. The vulnerability is network-accessible with no authentication requirement and no user interaction needed. An attacker can trigger agent workflows that execute LLM calls, tool invocations, file operations, or code execution as defined in the agents.yaml configuration. The issue was introduced in version 4.6.34 when the serve subsystem was added, and is patched in 4.6.58.
Affected products
- MervinPraison PraisonAI >=4.6.34, <4.6.58
Timeline
- 2026-08-25: disclosed: Published to GitHub Advisory Database
- 2026-06-13: patched: Patched in version 4.6.58
- 2026-06-02: other: Vulnerability confirmed on version 4.6.50
- 2026-04-01: other: Vulnerability likely introduced in version 4.6.34 when serve subsystem shipped