CVE-2026-55541: PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

August 25, 2026

praisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI.

References

github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pvxx-r596-f5qj
github.com/advisories/GHSA-pvxx-r596-f5qj
nvd.nist.gov/vuln/detail/CVE-2026-55541

Code Behaviors & Features

Detect and mitigate CVE-2026-55541 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →