PraisonAI CVE-2026-55541

No special conditions are required beyond network access to the serve port - the vulnerability affects all praisonai serve agents and praisonai serve unified deployments running versions prior to 4.6.58, including those where --api-key has been explicitly set (the flag is inert). Exploitation is limited to attackers with network reachability to the FastAPI serve port; if the server is bound to localhost only, exploitation is restricted to local attackers or those with an existing foothold. The bug is specific to the newer serve subsystem (introduced in 4.6.34) and does not affect users relying solely on the legacy deploy/api.py interface. No authentication, elevated privileges, or specific agent configuration is required by the attacker.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H) accurately reflects the attack surface: fully network-reachable, no complexity, no privilege requirement, no user interaction required. High integrity and availability impact stem from the ability to trigger arbitrary agent workflows remotely. Confidentiality is rated low (VC:L), which may understate risk if deployed agents have access to sensitive data stores - defenders should audit their agent configurations. No EPSS data was provided in the input. The CVE is not in CISA KEV at time of analysis, so active exploitation at scale has not been confirmed. However, a functional public proof-of-concept exists, meaning exploitation requires minimal skill from any network-adjacent attacker. The real-world risk is concentrated on deployments that expose the serve port to untrusted networks while believing the --api-key flag provides protection - a plausible misconfiguration given the flag's documented purpose.

A remote unauthenticated attacker who can reach the PraisonAI serve port sends a crafted POST request to /agents or /api/v1/agents/{id}/invoke without any Authorization header, and the FastAPI application processes the request as fully authorized, executing the requested agent workflow with server-side privileges. Because a public proof-of-concept script is documented in GHSA-pvxx-r596-f5qj, exploitation requires minimal skill and no prior knowledge of the configured API key. Depending on agent configuration, the attacker may exfiltrate data, invoke integrated tools (such as web crawlers or code search utilities), or exhaust server resources by flooding the agent pipeline.