CVE-2026-55538

### Summary `praisonai serve agents` exposes HTTP routes that invoke registered agents. The CLI advertises `--api-key` with help text "API key for authentication", parses it, and forwards it into `ServeHandler`. But `_create_agents_app()` **never reads `config["api_key"]` again** and installs no auth dependency or middleware on its direct routes. The configured key is a no-op flag. As a result, an unauthenticated network caller can invoke exposed agents (`POST /agents` and `POST /agents/{agent_name}`) even when the operator passed `--api-key`. Requests with no credentials, a wrong `Authorization: Bearer`, a wrong `X-API-Key`, or an empty bearer all reach `agent.start()`. The failure is made sharper by the fact that a **working auth dependency already exists in the same module** — `praisonai.api.agent_invoke.verify_token` guards every `/api/v1/...` route with `Depends(verify_token)` and is mounted into the very same app. The direct n8n-compat routes simply do not use it. ## Technical Detail ### Source-to-sink trace **1. CLI advertises and forwards `--api-key`:** ```python # cli/commands/serve.py @app.command("agents") def serve_agents(..., api_key: Optional[str] = typer.Option(None, "--api-key", help="API key for authentication")): ... if api_key: args.extend(["--api-key", api_key]) exit_code = handle_serve_command(args) ``` **2. `cmd_agents()` parses `api_key` into the spec — and that is the last time it is touched:** ```python # cli/features/serve.py — cmd_agents() spec = { ..., "api_key": {"default": None} } parsed = self._parse_args(args, spec) app = self._create_agents_app(parsed) ``` A grep of the entire `cli/features/serve.py` for `api_key` returns **only** the two `spec` entries (`cmd_agents` line ~199 and `cmd_unified` line ~847). `config["api_key"]` is never read inside `_create_agents_app()` / `_create_unified_app()`; it is never compared, and no dependency is attached. **3. `_create_agents_app()` imports `FastAPI, HT