Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-55528

praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MervinPraison PraisonAI

  • < 4.6.58affected

MervinPraison praisonaiagents

  • < 1.6.58affected

References