CVE-2026-55528: praisonaiagents: AgentServer declares auth_token but never enforces it on any route

August 25, 2026

Researcher: Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI

Package: praisonaiagents on PyPI Affected version (empirically tested): 1.6.48 Component: praisonaiagents.server.AgentServer (the bundled HTTP / SSE server)

References

github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7g3p-92qq-8wvh
github.com/advisories/GHSA-7g3p-92qq-8wvh
nvd.nist.gov/vuln/detail/CVE-2026-55528

Code Behaviors & Features

Detect and mitigate CVE-2026-55528 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →