GHSA-x8cv-xmq7-p8xp

# PraisonAI `AgentTeam.launch()` exposes unauthenticated remote agent invocation endpoints ## Summary PraisonAI's documented Python `AgentTeam.launch()` / `Agents.launch()` HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement. The current implementation registers `GET /{path}/list`, `POST /{path}`, and `POST /{path}/{agent_id}` routes. The POST routes directly call `agent.chat(...)`. Requests with no `Authorization` header are accepted, and requests with an obviously wrong bearer token are also accepted. The default Python API bind host for `Agents.launch()` is `0.0.0.0`, and official documentation shows `host="0.0.0.0"` for remote access. This is a sibling/incomplete-fix variant of PraisonAI's prior unauthenticated API server and call server advisory family. Nearby server surfaces were hardened to require tokens, fail closed, or bind locally by default, but the `AgentTeam.launch()` FastAPI path still exposes unauthenticated agent execution on current upstream main and the latest release. This report is scoped to the Python `AgentTeam.launch()` / `Agents.launch()` route-registration path. It does not require adjudicating whether the separate `praisonai serve agents --api-key` CLI path is correctly enforced. ## Affected Components - Package: `praisonaiagents` - Current upstream main tested: `2f9677abb2ea68eab864ee8b6a828fd0141612e1` - Latest release tag tested: `v4.6.57` - Primary file: `src/praisonai-agents/praisonaiagents/agents/agents.py` - Current line references: `AgentTeam.launch()` begins at line 1923; the group `POST` route is registered at line 2007; the group handler invokes `agent_instance.chat(...)` at line 2042; the unauthenticated list route is registered at line 2086; per-agent handlers invoke `agent.chat(...)` at line 2117. - Primary class/API: `AgentTeam.launch()` / exported alias `Agents` - Affected routes: - `GET /{path}/list`: lists deployed agents. - `POST /{path}`: sequentia