https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T18:17:08.918387+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-55528 CVE-2026-55528 — praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862) 2026-10-02T18:17:08.935613+00:00

Affected: MervinPraison PraisonAI, MervinPraison praisonaiagents

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.