{"data":{"id":"91977016-bcf9-4ab7-8d94-27c104d6aab3","title":"GHSA-pvxx-r596-f5qj: PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced","summary":"PraisonAI's `praisonai serve` command accepts an `--api-key` flag for authentication, but the flag is parsed and never actually used to protect the server. The FastAPI application (a web framework for building APIs) is created without any authentication middleware (code that checks credentials before allowing access), leaving endpoints like `POST /agents` completely open to anyone, even though the help text promises the key would protect them. This affects version 4.6.50 and likely all versions since 4.6.34 when the serve system was introduced.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-pvxx-r596-f5qj","publishedAt":"2026-08-25T15:06:09.000Z","cveId":"CVE-2026-55541","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["PraisonAI@< 4.6.58 (fixed: 4.6.58)"],"affectedVendors":[],"affectedVendorsRaw":["PraisonAI"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-08-25T15:06:09.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}