CVE-2026-55541CWE-862broken-access-control

CVE-2026-55541

published August 25, 2026

CVSS
8.8
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app() and _create_unified_app() do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/{id}/invoke. This issue is fixed in version 4.6.58.

The record
Technical detail
CVSS
8.8 · NONE
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00480 · 40.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-25T19:16Z
References (3)
https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1 · [email protected]https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58 · [email protected]https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pvxx-r596-f5qj · [email protected]
EPSS history
Timeline
  • 27 AUG 06:36Z
    EPSS moved — → 0%
    epss
  • 25 AUG 15:05Z
    PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
    cvelistv5