THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-pvxx-r596-f5qj (high) — PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

[GHSA] GHSA-pvxx-r596-f5qj (high) — PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

medgithub_advisoriesPublished 2026-08-25

GHSA-pvxx-r596-f5qj Severity: high CVE: CVE-2026-55541

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

## Summary

`praisonai serve agents` and `praisonai serve unified` both accept `--api-key` for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. T

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-55541cve
CVE-2026-44338cve

Original source: https://github.com/advisories/GHSA-pvxx-r596-f5qj