{"vulnerability": "CVE-2026-55541", "sightings": [{"uuid": "0d9e744f-cc71-4461-be15-73154aca3249", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55541", "type": "published-proof-of-concept", "source": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pvxx-r596-f5qj", "content": "", "creation_timestamp": "2026-08-25T16:35:26.278959Z"}, {"uuid": "5c1782a1-423c-45ad-bb8d-5e782c4667e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55541", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtx4gsv7ss2f", "content": "CVE-2026-55541 - praisonai\nThe PraisonAI command that should require an API key does not actually check it, leaving the server accessible to anyone. This affects versions from 4.6.34 onward,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#praisonai #mervinpraison #pip #CVE #infosec", "creation_timestamp": "2026-08-26T00:50:04.621517Z"}, {"uuid": "9e305432-3698-441e-8252-bd0c16ac7de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55541", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mtw4n5te3z2v", "content": "PraisonAI's `praisonai serve agents` and `serve unified` parse `--api-key` but never wire it into the FastAPI app \u2014 no middleware, no header check. CVE-2026-55541, HIGH, confirmed on 4.6.50: the server runs open regardless of the key you set. #dev", "creation_timestamp": "2026-08-25T15:20:58.165186Z"}]}