CVSS 3.1
7.3 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCVE-2026-55538
High (7.3). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in praisonai 4.6.58.
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config["api_key"] but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. Missing or incorrect bearer and X-API-Key values still reach agent execution. This issue is fixed in version 4.6.58.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWE
- CWE-306
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r7v3-x45f-g7hp | PyPI | praisonai | <4.6.58 | 4.6.58 |
| PYSEC-2026-3894 | PyPI | praisonai | <4.6.58 | 4.6.58 |
References
- https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
- https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-r7v3-x45f-g7hp
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-r7v3-x45f-g7hp