PraisonAI is a multi-agent teams system. From praisonai 4.6.34 until 4.6.58, praisonai serve agents accepts --api-key but _create_agents_app() does not authenticate POST /agents or POST /agents/{agent_name}. A network caller can invoke configured agents without credentials even when an API key was supplied. This issue is fixed in version 4.6.58.

A missing authentication vulnerability exists in PraisonAI versions 4.6.34 through 4.6.57, a multi-agent teams system. The application accepts an --api-key parameter via the 'praisonai serve agents' command, but the internal _create_agents_app() function fails to enforce authentication on POST /agents and POST /agents/{agent_name} endpoints. This allows any network caller to invoke configured agents without supplying credentials, even when an API key has been configured. The vulnerability essentially renders the API key mechanism ineffective, exposing agent functionality to unauthorized access. The flaw was fixed in version 4.6.58 via a committed patch. Users are advised to upgrade immediately to the patched release to prevent unauthorized agent invocation.