Read the docs
TI-2026-79624 Aliases CVE-2026-57146

Missing authentication in PraisonAI A2U event routes by default

Priority HIGH 72CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-306.

Summary

PraisonAI from 4.5.115 before 4.6.61 exposes its A2U subscription and event routes without authentication when the documented CLI entrypoint is started. The CLI wrapper does not configure authentication, and the route helper skips the check when A2U_AUTH_TOKEN is unset, which is a missing authentication check (CWE-306). An unauthenticated remote attacker can subscribe to A2U event streams and read sensitive information.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0049 42nd percentileScored 2026-11-07
Fix Fixed PraisonAI (MervinPraison): 4.6.61praisonai (PyPI): 4.6.61

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MervinPraisonPraisonAI4.5.115 to before 4.6.614.6.61Patch availableCNA
—praisonai (PyPI)4.5.115 to before 4.6.614.6.61Patch availableGHSA-jxcw-qp4h-6jfq
  • PraisonAI VendorMervinPraison Affected 4.5.115 to before 4.6.61 Fixed in 4.6.61 Patch available CNA
  • praisonai (PyPI) Vendor— Affected 4.5.115 to before 4.6.61 Fixed in 4.6.61 Patch available GHSA-jxcw-qp4h-6jfq

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:*——MervinPraison
  • cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions — — ·MervinPraison

Remediation

Upgrade the praisonai package on PyPI to 4.6.61, which fixes this issue. The sources list no fixed version for PraisonAI.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA PraisonAI (MervinPraison) Fixed in 4.6.61
  • Fix · GHSA-jxcw-qp4h-6jfq praisonai (PyPI) Fixed in 4.6.61 Advisory →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-57146
  2. 2026-10-24 Priority changed: MEDIUM → LOW
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: LOW → HIGH

References

Other 2

  • TI-2026-79619 Missing authentication in PraisonAI AgentOS exposes agent chat CVSS 3.1CRITICAL 9.8
  • TI-2026-71236 Missing access control in PraisonAI AgentTeam exposes agent endpoints CVSS 3.1CRITICAL 9.8
  • TI-2026-44052 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent CVSS 4.0CRITICAL 10.0
  • TI-2026-41123 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) CVSS 3.1CRITICAL 9.8
  • TI-2026-41122 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery CVSS 3.1CRITICAL 9.8
  • TI-2026-41118 PraisonAI MCPServer exposes unauthenticated HTTP tools/call CVSS 3.1CRITICAL 9.8
See all 177 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences