CVE-2026-55541: PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

August 25, 2026

praisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI.

References

github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pvxx-r596-f5qj
github.com/advisories/GHSA-pvxx-r596-f5qj
nvd.nist.gov/vuln/detail/CVE-2026-55541

Code Behaviors & Features

Detect and mitigate CVE-2026-55541 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →