CVE-2026-55534

published 2026-08-25

CVE-2026-55534: PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not…

Priority P3 52 high 8.6 CVSS 3.1

AV N AC L PR N UI N S U C L I L A H

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke configured agents without credentials even when an API key was supplied. This issue is fixed in version 4.6.58.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mervinpraison	praisonai	—	—
mervinpraison	praisonai	>= 4.6.34 < 4.6.58	4.6.58

CVSS provenance

nvd v3.1 8.6 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

ghsa 7.3 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306