GHSA-pvxx-r596-f5qj: PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
highvulnerability
security
Summary
PraisonAI's `praisonai serve` command accepts an `--api-key` flag for authentication, but the flag is parsed and never actually used to protect the server. The FastAPI application (a web framework for building APIs) is created without any authentication middleware (code that checks credentials before allowing access), leaving endpoints like `POST /agents` completely open to anyone, even though the help text promises the key would protect them. This affects version 4.6.50 and likely all versions since 4.6.34 when the serve system was introduced.
Vulnerability Details
EPSS (30-day exploit probability)
EPSS: 0.0%
Patch Available
Yes
Disclosure Date
August 25, 2026
Classification
Attack Type
Other
Attack SophisticationTrivial
Impact (CIA+S)
confidentialityintegrity
Affected Vendors
Affected Packages
PraisonAI@< 4.6.58 (fixed: 4.6.58)
Related Issues
Monthly digest — independent AI security research
Original source: https://github.com/advisories/GHSA-pvxx-r596-f5qj
First tracked: August 25, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 95%