PT-2026-81328

🗓️ 25 Aug 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 13 Views

PraisonAI before 4.6.58 lacks auth on agent endpoints allowing unauthenticated agent execution.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-55538	25 Aug 202616:35	–	circl
CVE	CVE-2026-55538	25 Aug 202614:56	–	cve
Cvelist	CVE-2026-55538 PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated	25 Aug 202614:56	–	cvelist
EUVD	EUVD-2026-65514	25 Aug 202614:56	–	euvd
Github Security Blog	PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated	25 Aug 202614:56	–	github
NVD	CVE-2026-55538	25 Aug 202615:16	–	nvd
OSV	GHSA-R7V3-X45F-G7HP PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated	25 Aug 202614:56	–	osv
OSV	PYSEC-2026-3894 PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated	10 Sep 202609:44	–	osv
PyPA	PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated	10 Sep 202609:44	–	pypa
Vulnrichment	CVE-2026-55538 PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated	25 Aug 202614:56	–	vulnrichment

Source	Link
github	www.github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
osv	www.osv.dev/vulnerability/PYSEC-2026-3894
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55538.json
github	www.github.com/MervinPraison/PraisonAI
github	www.github.com/advisories/GHSA-r7v3-x45f-g7hp
twitter	www.twitter.com/HugoValters/status/2092313055141245139
pypi	www.pypi.org/project/praisonai
github	www.github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-55538
osv	www.osv.dev/vulnerability/GHSA-r7v3-x45f-g7hp

10 Sep 2026 00:00Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.3

EPSS0.00258

SSVC

PraisonAI missing authentication agent endpoints unauthenticated execution broken access control