Multi-agent System Vulnerability in PraisonAI by Mervin Praison
CVE-2026-55541

8.8HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
25 August 2026

What is CVE-2026-55541?

PraisonAI, a multi-agent teams system, has a flaw in its credential validation process that allows unauthenticated users to access sensitive endpoints. Specifically, the functions _create_agents_app() and _create_unified_app() lack necessary credential checks, permitting unauthorized access to POST requests at /agents and /api/v1/agents/{id}/invoke. This vulnerability has been addressed in version 4.6.58, which implements the appropriate security measures to prevent these unauthorized actions.

Affected Version(s)

PraisonAI < 4.6.58

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM
https://github.com/MervinPraison/PraisonAI/commit/2f9677a...
x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/releases/tag/v...
x_refsource_MISC

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.