Authentication Bypass in PraisonAI Affects Multi-Agent System
CVE-2026-55534

8.6HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
25 August 2026

What is CVE-2026-55534?

PraisonAI versions 4.6.34 to 4.6.57 suffer from an authentication bypass vulnerability. The system, which is designed to manage multi-agent teams, improperly handles authentication for agents. Specifically, while support for API keys is available, the _create_agents_app() function fails to authenticate agent creation requests sent via POST /agents or POST /agents/{agent_name}. This flaw allows network callers to invoke agents without needing proper credentials, even when an API key should be required. This vulnerability has been addressed in version 4.6.58, ensuring that proper authentication protocols are enforced for all agent interactions.

Affected Version(s)

PraisonAI >= 4.6.34, < 4.6.58

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM
https://github.com/MervinPraison/PraisonAI/commit/2f9677a...
x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/releases/tag/v...
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.