PraisonAI's serve agents component ignores the supplied --api-key, permitting unauthenticated callers to POST to /agents or /agents/{agent_name}. The authentication bypass allows an attacker to invoke configured agents without credentials, potentially enabling arbitrary code execution by leveraging the agents’ capabilities. The vulnerability is classified as CWE-306, indicating a flaw that allows authentication to be bypassed or circumvented.

The vulnerability affects MervinPraison PraisonAI versions 4.6.34 through 4.6.58. The issue is fixed in version 4.6.58; any instance running an earlier release is vulnerable.

With a CVSS score of 8.6, the flaw is considered high severity. Although an EPSS score is not available, the lack of authentication combined with exposed network endpoints makes exploitation straightforward for anyone with network access to the service. The vulnerability is not listed in CISA's KEV catalog, but its high severity and ease of exploitation warrant immediate attention.