GHSA-r7v3-x45f-g7hp: PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

Summary

The `praisonai serve agents` command accepts `--api-key` and forwards it to `ServeHandler`, but `_create_agents_app()` never reads `config["api_key"]` and attaches no auth dependency or middleware to its direct routes. As a result, unauthenticated network callers can invoke registered agents through `POST /agents` and `POST /agents/{agent_name}` even when the operator sets `--api-key`, and requests with missing, wrong, or empty credentials all reach `agent.start()`. The existing `verify_token` dependency in `praisonai.api.agent_invoke` protects the `/api/v1/...` routes in the same app, but the direct routes do not use it, and `verify_token` reads the `CALL_SERVER_TOKEN` environment variable rather than the CLI option.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
• HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database
• HighCVE-2026-122133: Mistral Vibe untrusted search path code execution via git.exe on WindowsSimilar attack · NVD/CVE Database
• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database