PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

Summary PraisonAI's praisonai serve agents command exposes --api-key as the documented authentication control for production/external deployments, but the configured key is not enforced on the public agent invocation compatibility endpoints. An operator can start the server with --api-key and bin...

CVE-2026-55534 PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but createagentsapp does not authenticate POST /agents or POST /agents/agentname. A network caller can invoke configured agents without credentials even when an API key was...

EUVD-2026-65500

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but createagentsapp does not authenticate POST /agents or POST /agents/agentname. A network caller can invoke configured agents without credentials even when an API key was...

CVE-2026-55534 PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but createagentsapp does not authenticate POST /agents or POST /agents/agentname. A network caller can invoke configured agents without credentials even when an API key was...

CVE-2026-44775

Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with AllowAnonymous, allowing completely unauthenticated access to page images from any chapter in any library. While the endpoint accepts an apiKey parameter, it is never validated. Sin...