PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

SummaryThe PraisonAI Recipe HTTP server silently allows unauthenticated requests when auth is configured as api-key or jwt but the corresponding secret is missing.This creates an authentication fail-open condition. An operator can start the Recipe server with authentication enabled, including on ...

PYSEC-2026-3889 PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret

Summary The PraisonAI Recipe HTTP server silently allows unauthenticated requests when auth is configured as api-key or jwt but the corresponding secret is missing. This creates an authentication fail-open condition. An operator can start the Recipe server with authentication enabled, including o...

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

Summarypraisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI. Affected...

PYSEC-2026-3894 PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

Summary praisonai serve agents exposes HTTP routes that invoke registered agents. The CLI advertises --api-key with help text "API key for authentication", parses it, and forwards it into ServeHandler. But createagentsapp never reads config"apikey" again and installs no auth dependency or...

PYSEC-2026-3893 PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

Summary praisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI. Affected...

PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

Summary PraisonAI's praisonai serve agents command exposes --api-key as the documented authentication control for production/external deployments, but the configured key is not enforced on the public agent invocation compatibility endpoints. An operator can start the server with --api-key and bin...

PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticated

Summarypraisonai serve agents exposes HTTP routes that invoke registered agents. The CLI advertises --api-key with help text "API key for authentication", parses it, and forwards it into ServeHandler. But createagentsapp never reads config"apikey" again and installs no auth dependency or middlewa...

Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Nearly one in ten of the internet-facing LiteLLM servers that Wiz Research scanned in February accepted sk-1234 , the example admin key in LiteLLM's own setup guide. LiteLLM is an open-source AI gateway, the software a company puts between its applications and the model providers it pays for. Tha...

PT-2026-89631

🚨 CVE-2026-81268 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation. 🎖@cveNotify...

PT-2026-89372

Capgo Cap-go/capgo.app contains an authentication bypass affecting all versions no patched version available at time of publication. The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor tha...

PT-2026-89373

Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/ backend/utils/hono middleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and...

CVE-2026-88013: Exposure of Sensitive Information to an Unauthorized Actor

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

Palo Alto Networks PAN-OS 0.0.x < 10.1.11 / 10.2.x < 10.2.8 / 11.0.x < 11.0.3 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 0.0.x prior to 10.1.11, 10.2.x prior to 10.2.8, or 11.0.x prior to 11.0.3. It is, therefore, affected by a vulnerability. A privilege escalation PE vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an...

Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

Public Runtime Config Exposes Ollama API Key to Browser Clients Summary [email protected] unconditionally merges all module options — including apikey — into Nuxt's public runtime config runtimeConfig.public.ollama. Nuxt serializes runtimeConfig.public into the SSR HTML response inside a payload...

GHSA-FXG7-897C-57MP Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

Public Runtime Config Exposes Ollama API Key to Browser Clients Summary [email protected] unconditionally merges all module options — including apikey — into Nuxt's public runtime config runtimeConfig.public.ollama. Nuxt serializes runtimeConfig.public into the SSR HTML response inside a payload...

CVE-2026-50165

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

EUVD-2026-75140

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

PT-2026-89149

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

CVE-2026-50165: Improper Access Control

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

Kibana 8.x < 8.19.21 / 9.0.3 < 9.4.6 Missing Authorization (ESA-2026-155)

The version of Kibana installed on the remote host is 8.x prior to 8.19.21, or 9.0.3 prior to 9.4.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-155 advisory. - Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential...