CVE-2026-57146 in PraisonAI
Summary
by MITRE • 10/23/2026
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in PraisonAI involves a critical authentication bypass within its Agent-to-User (A2U) event streaming functionality. Although an earlier advisory, GHSA-f292-66h9-fpmf, indicated that unauthenticated A2U event streaming was resolved in version 4.5.115, subsequent analysis reveals that the flaw persists in versions leading up to and including those prior to 4.6.61. The core issue stems from a misconfiguration in the CLI wrapper used to start the application service. Specifically, the current command-line interface does not expose an option for providing an API key nor does it install the necessary middleware required to enforce authentication policies on incoming requests. Furthermore, the initialization process fails to generate or inject a token specifically designated for A2U communication channels.
From a technical perspective, the root cause lies in how the application initializes its routing logic through the create_a2u_routes helper function. This utility is designed to apply security constraints only if an environment variable named A2U_AUTH_TOKEN is explicitly defined and present within the execution context. When this variable is absent, which occurs by default due to the CLI wrapper's limitations, the internal _authenticate_request routine returns None. Consequently, the system interprets this null result as a directive to disable authentication entirely for all associated event routes. This architectural oversight allows any client on the network to subscribe to and receive real-time agent events without providing valid credentials, effectively rendering the security controls inert in standard deployment scenarios.
The operational impact of this vulnerability is significant, particularly regarding data confidentiality and integrity. Since A2U streams typically contain sensitive information such as internal reasoning processes, tool outputs, or user interactions processed by autonomous agents, unauthorized access exposes these details to potential attackers. This aligns with CWE-306, which describes the failure to provide a critical authentication mechanism, allowing unauthenticated actors to interact with protected resources. Additionally, this flaw maps to MITRE ATT&CK technique T1505.003, Server Message Block (SMB) Events or similar event-based data exfiltration methods where attackers can harvest real-time operational intelligence without detection. The lack of authentication means that any entity capable of reaching the service endpoint can subscribe to these streams, potentially leading to information disclosure and aiding further reconnaissance efforts against the underlying AI infrastructure.
To mitigate this risk, operators must ensure they are running version 4.6.61 or later where the patch has been officially applied. For environments still operating on vulnerable versions, immediate remediation involves manually setting the A2U_AUTH_TOKEN environment variable before launching the service. This forces the create_a2u_routes function to engage its authentication checks by ensuring _authenticate_request does not return None. Additionally, organizations should review their deployment configurations to ensure that API key middleware is correctly installed and that CLI wrappers are updated or customized to support secure credential injection mechanisms. Regular auditing of environment variables and access control lists for AI agent interfaces is recommended to prevent similar misconfigurations in multi-agent systems where real-time data streams are exposed.