{"data":{"id":"91977016-bcf9-4ab7-8d94-27c104d6aab3","title":"GHSA-pvxx-r596-f5qj: PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced","summary":"PraisonAI's `praisonai serve agents` and `praisonai serve unified` accept `--api-key` but never wire it into the FastAPI app, so no middleware or header check runs. The server stays open regardless of the key, as confirmed on 4.6.50 and likely since 4.6.34, affecting `src/praisonai/praisonai/cli/features/serve.py`.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-pvxx-r596-f5qj","publishedAt":"2026-08-25T15:06:09.000Z","cveId":"CVE-2026-55541","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["PraisonAI@< 4.6.58 (fixed: 4.6.58)"],"affectedPackageNames":["praisonai"],"affectedPackageRefs":["pypi:praisonai"],"affectedVendors":[],"affectedVendorsRaw":["PraisonAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0048,"epssCheckedAt":"2026-11-05T06:10:16.029Z","kevDateAdded":null,"advisoryAliases":["GHSA-pvxx-r596-f5qj"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-08-25T15:06:09.000Z","fixReleasedAt":"2026-06-13T12:32:36.798Z","daysToFix":-73,"fixCheckedAt":"2026-10-29T21:31:19.993Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"PraisonAI","fixedVersion":"4.6.58","matchedVersion":"4.6.58","fixReleasedAt":"2026-06-13T12:32:36.798Z","daysToFix":-73,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:31:19.847Z"}]}}