HighVulnerability
GHSA-pvxx-r596-f5qj: PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
- Identifiers
- CVE-2026-55541GHSA-pvxx-r596-f5qj
- Published
- Record updated
- Affected
- PraisonAI < 4.6.58
- Fixed in
- 4.6.58
- released June 13, 2026, 73 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
PraisonAI's `praisonai serve agents` and `praisonai serve unified` accept `--api-key` but never wire it into the FastAPI app, so no middleware or header check runs. The server stays open regardless of the key, as confirmed on 4.6.50 and likely since 4.6.34, affecting `src/praisonai/praisonai/cli/features/serve.py`.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
- MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database
- MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
- HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
- HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database