CVE-2026-55538: CWE-306: Missing Authentication for Critical Function in MervinPraison PraisonAI

PraisonAI versions before 4.6.58 suffer from a missing authentication vulnerability (CWE-306) in the _create_agents_app() function. Although the system parses the config["api_key"], it does not enforce authentication on POST /agents or POST /agents/{agent_name} endpoints. As a result, requests lacking valid bearer tokens or X-API-Key headers can still trigger agent execution. This flaw allows unauthorized users to interact with critical agent functions. The vulnerability is addressed in PraisonAI version 4.6.58.

The vulnerability allows unauthenticated attackers to invoke critical agent functions via POST requests without valid authentication tokens. This can lead to unauthorized access and potentially compromise the confidentiality, integrity, and availability of the system. The CVSS 3.1 score of 7.3 reflects high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

A fix is available in PraisonAI version 4.6.58. Users should upgrade to this version or later to remediate the missing authentication vulnerability. No other mitigation guidance is provided or required.