Vulnerability-Lookup

CVE-2026-57146 (GCVE-0-2026-57146)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:08 – Updated: 2026-10-23 12:08

Title

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

Summary

PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7761 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/MervinPraison/PraisonAI/securi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
MervinPraison	PraisonAI	Affected: >= 4.5.115, < 4.6.61	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.5.115, \u003c 4.6.61"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:08:16.479Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jxcw-qp4h-6jfq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jxcw-qp4h-6jfq"
        }
      ],
      "source": {
        "advisory": "GHSA-jxcw-qp4h-6jfq",
        "discovery": "UNKNOWN"
      },
      "title": "PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57146",
    "datePublished": "2026-10-23T12:08:16.479Z",
    "dateReserved": "2026-06-24T01:45:48.697Z",
    "dateUpdated": "2026-10-23T12:08:16.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-57146",
      "date": "2026-10-24",
      "epss": "0.00485",
      "percentile": "0.40857"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "PraisonAI",
                "vendor": "MervinPraison",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 4.5.115, \u003c 4.6.61"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61."
          }
        ],
        "id": "CVE-2026-57146",
        "lastModified": "2026-10-23T13:17:11.647",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-23T13:17:11.527",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jxcw-qp4h-6jfq"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              },
              {
                "lang": "en",
                "value": "CWE-306"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-57146

Vulnerability from fkie_nvd - Published: 2026-10-23 13:17 - Updated: 2026-10-23 13:17

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jxcw-qp4h-6jfq

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.5.115, \u003c 4.6.61"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61."
    }
  ],
  "id": "CVE-2026-57146",
  "lastModified": "2026-10-23T13:17:11.647",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-23T13:17:11.527",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jxcw-qp4h-6jfq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-JXCW-QP4H-6JFQ

Vulnerability from github – Published: 2026-06-18 14:27 – Updated: 2026-07-20 21:31

Summary

PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

Details

Summary

The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint:

praisonai serve a2u --host 0.0.0.0 --port 8002

The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled.

This is an incomplete-fix report for the published A2U issue, not a separate trust-model-only concern.

Technical Details

The Typer command for A2U accepts only --host and --port:

src/praisonai/praisonai/cli/commands/serve.py:570-585

It forwards only those values to the shared serve handler:

args = ["a2u", "--host", host, "--port", str(port)]

The serve handler for A2U likewise accepts only host and port, then creates the app:

src/praisonai/praisonai/cli/features/serve.py:802-817

_create_a2u_app() registers A2U routes directly:

src/praisonai/praisonai/cli/features/serve.py:827-853

No call to _install_api_key_middleware(app, ...) is made for the dedicated A2U server, unlike the unified server path.

Inside create_a2u_routes(), auth is opt-in:

src/praisonai/praisonai/endpoints/a2u_server.py:245-253

auth_token = os.environ.get("A2U_AUTH_TOKEN")
if not auth_token:
    # No token configured - auth disabled (development mode)
    return None

The route helper then registers the same sensitive endpoints from the public advisory:

src/praisonai/praisonai/endpoints/a2u_server.py:391-409

Why This Is Not Intended Behavior

The public advisory for GHSA-f292-66h9-fpmf describes unauthenticated /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health as the vulnerability and lists 4.5.115 as patched.

Current documentation also says PraisonAI API servers are now secure by default, bind to 127.0.0.1, and generate a bearer token if no token is provided. The dedicated A2U command does not implement that secure-by-default behavior. It remains unauthenticated unless a different environment variable, A2U_AUTH_TOKEN, was set before startup.

This report does not claim that explicit local-only development mode is always a vulnerability. The issue is the mismatch between the published fixed version / secure-by-default posture and the current A2U CLI behavior, including external binding via --host 0.0.0.0.

PoV

Run:

python3 poc/pov_poc.py \
  --repo /path/to/PraisonAI \
  --json

Observed current-head output:

{
  "no_token": {
    "info_status_no_auth": 200,
    "subscribe_status_no_auth": 200,
    "health_status_no_auth": 200,
    "subscribe_body": {
      "stream_name": "events",
      "stream_url": "http://testserver/a2u/events/sub-d8ee868a5491"
    }
  },
  "with_token": {
    "info_status_no_auth": 401,
    "subscribe_status_no_auth": 401,
    "info_with_token": 200,
    "subscribe_with_token": 200
  },
  "vulnerable_current_default": true
}

The PoV is local-only. It uses a small Starlette response/route shim so it can invoke the registered A2U handlers without starting a network listener or installing dependencies. The control shows that the route-level token check works when A2U_AUTH_TOKEN is configured; the vulnerable behavior is that the current documented CLI path does not require or generate that token.

PoC

The PoV section above contains the local reproduction command, input, and decisive output.

Impact

An attacker who can reach a current A2U server started without A2U_AUTH_TOKEN can subscribe to agent event streams without credentials. The prior public advisory already classifies the exposed data as agent responses, tool calls, thinking/progress events, and stream metadata.

If operators rely on the published fixed version or the secure-by-default serve documentation, they may expose A2U on a network interface believing the unauthenticated stream issue is fixed.

Severity

Suggested severity: High.

Suggested Fix

Recommended:

Make praisonai serve a2u secure by default in the same way as the documented API servers: generate a bearer token when none is configured, print it to stderr, and enforce it on all non-public A2U endpoints.
Add --api-key / --auth-token support to the dedicated A2U command and pass the configured token into create_a2u_routes() or shared middleware.
Fail closed for external binds such as --host 0.0.0.0 unless authentication is enabled.
Require auth on /a2u/health or remove subscription and stream counts from unauthenticated health responses.
Add regression tests for praisonai serve a2u proving unauthenticated /a2u/subscribe returns 401 on current/fixed versions by default.

Affected Package/Versions

Repository: MervinPraison/PraisonAI
Ecosystem: pip
Package: praisonai
Component: A2U Agent-to-User event stream server
Current checkout validated: 2f9677abb2ea68eab864ee8b6a828fd0141612e1
Current checkout tag state: v4.6.57-4-g2f9677ab
Public prior advisory: GHSA-f292-66h9-fpmf, fixed range claims praisonai <= 4.5.114

Suggested affected range:

pip:praisonai >= 4.5.115, <= 4.6.58

If maintainers prefer to update the public advisory rather than create a new advisory, the important correction is that the fixed version/range should not mark the current praisonai serve a2u behavior as fixed.

Advisory History

This is intentionally adjacent to GHSA-f292-66h9-fpmf. The report-grade point is that current versions after the claimed patched version still reproduce the same default unauthenticated A2U behavior through the maintained CLI entrypoint.

Visible PraisonAI advisories and prior submissions were checked. None cover A2U incomplete authentication after GHSA-f292-66h9-fpmf.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.5.115"
            },
            {
              "fixed": "4.6.61"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57146"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:27:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe published A2U advisory `GHSA-f292-66h9-fpmf` says unauthenticated A2U event streaming was fixed in `praisonai` `4.5.115`. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint:\n\n```text\npraisonai serve a2u --host 0.0.0.0 --port 8002\n```\n\nThe current CLI wrapper does not expose `--api-key`, does not install the common API-key middleware, and does not generate a token for A2U. It calls `create_a2u_routes(app)` directly. That helper only enforces auth if `A2U_AUTH_TOKEN` is already present; if the variable is missing, `_authenticate_request()` returns `None` and treats auth as disabled.\n\nThis is an incomplete-fix report for the published A2U issue, not a separate trust-model-only concern.\n\n## Technical Details\n\nThe Typer command for A2U accepts only `--host` and `--port`:\n\n```text\nsrc/praisonai/praisonai/cli/commands/serve.py:570-585\n```\n\nIt forwards only those values to the shared serve handler:\n\n```python\nargs = [\"a2u\", \"--host\", host, \"--port\", str(port)]\n```\n\nThe serve handler for A2U likewise accepts only `host` and `port`, then creates the app:\n\n```text\nsrc/praisonai/praisonai/cli/features/serve.py:802-817\n```\n\n`_create_a2u_app()` registers A2U routes directly:\n\n```text\nsrc/praisonai/praisonai/cli/features/serve.py:827-853\n```\n\nNo call to `_install_api_key_middleware(app, ...)` is made for the dedicated A2U server, unlike the unified server path.\n\nInside `create_a2u_routes()`, auth is opt-in:\n\n```text\nsrc/praisonai/praisonai/endpoints/a2u_server.py:245-253\n```\n\n```python\nauth_token = os.environ.get(\"A2U_AUTH_TOKEN\")\nif not auth_token:\n    # No token configured - auth disabled (development mode)\n    return None\n```\n\nThe route helper then registers the same sensitive endpoints from the public advisory:\n\n```text\nsrc/praisonai/praisonai/endpoints/a2u_server.py:391-409\n```\n\n### Why This Is Not Intended Behavior\n\nThe public advisory for `GHSA-f292-66h9-fpmf` describes unauthenticated `/a2u/info`, `/a2u/subscribe`, `/a2u/events/{stream_name}`, `/a2u/events/sub/{id}`, and `/a2u/health` as the vulnerability and lists `4.5.115` as patched.\n\nCurrent documentation also says PraisonAI API servers are now secure by default, bind to `127.0.0.1`, and generate a bearer token if no token is provided. The dedicated A2U command does not implement that secure-by-default behavior. It remains unauthenticated unless a different environment variable, `A2U_AUTH_TOKEN`, was set before startup.\n\nThis report does not claim that explicit local-only development mode is always a vulnerability. The issue is the mismatch between the published fixed version / secure-by-default posture and the current A2U CLI behavior, including external binding via `--host 0.0.0.0`.\n\n## PoV\n\nRun:\n\n```bash\npython3 poc/pov_poc.py \\\n  --repo /path/to/PraisonAI \\\n  --json\n```\n\nObserved current-head output:\n\n```json\n{\n  \"no_token\": {\n    \"info_status_no_auth\": 200,\n    \"subscribe_status_no_auth\": 200,\n    \"health_status_no_auth\": 200,\n    \"subscribe_body\": {\n      \"stream_name\": \"events\",\n      \"stream_url\": \"http://testserver/a2u/events/sub-d8ee868a5491\"\n    }\n  },\n  \"with_token\": {\n    \"info_status_no_auth\": 401,\n    \"subscribe_status_no_auth\": 401,\n    \"info_with_token\": 200,\n    \"subscribe_with_token\": 200\n  },\n  \"vulnerable_current_default\": true\n}\n```\n\nThe PoV is local-only. It uses a small Starlette response/route shim so it can invoke the registered A2U handlers without starting a network listener or installing dependencies. The control shows that the route-level token check works when `A2U_AUTH_TOKEN` is configured; the vulnerable behavior is that the current documented CLI path does not require or generate that token.\n\n## PoC\n\nThe PoV section above contains the local reproduction command, input, and decisive output.\n\n## Impact\n\nAn attacker who can reach a current A2U server started without `A2U_AUTH_TOKEN` can subscribe to agent event streams without credentials. The prior public advisory already classifies the exposed data as agent responses, tool calls, thinking/progress events, and stream metadata.\n\nIf operators rely on the published fixed version or the secure-by-default serve documentation, they may expose A2U on a network interface believing the unauthenticated stream issue is fixed.\n\n### Severity\n\nSuggested severity: High.\n\n## Suggested Fix\n\nRecommended:\n\n1. Make `praisonai serve a2u` secure by default in the same way as the documented API servers: generate a bearer token when none is configured, print it to stderr, and enforce it on all non-public A2U endpoints.\n2. Add `--api-key` / `--auth-token` support to the dedicated A2U command and pass the configured token into `create_a2u_routes()` or shared middleware.\n3. Fail closed for external binds such as `--host 0.0.0.0` unless authentication is enabled.\n4. Require auth on `/a2u/health` or remove subscription and stream counts from unauthenticated health responses.\n5. Add regression tests for `praisonai serve a2u` proving unauthenticated `/a2u/subscribe` returns `401` on current/fixed versions by default.\n\n## Affected Package/Versions\n\n- Repository: `MervinPraison/PraisonAI`\n- Ecosystem: `pip`\n- Package: `praisonai`\n- Component: A2U Agent-to-User event stream server\n- Current checkout validated: `2f9677abb2ea68eab864ee8b6a828fd0141612e1`\n- Current checkout tag state: `v4.6.57-4-g2f9677ab`\n- Public prior advisory: `GHSA-f292-66h9-fpmf`, fixed range claims `praisonai \u003c= 4.5.114`\n\nSuggested affected range:\n\n```text\npip:praisonai \u003e= 4.5.115, \u003c= 4.6.58\n```\n\nIf maintainers prefer to update the public advisory rather than create a new advisory, the important correction is that the fixed version/range should not mark the current `praisonai serve a2u` behavior as fixed.\n\n## Advisory History\n\nThis is intentionally adjacent to `GHSA-f292-66h9-fpmf`. The report-grade point is that current versions after the claimed patched version still reproduce the same default unauthenticated A2U behavior through the maintained CLI entrypoint.\n\nVisible PraisonAI advisories and prior submissions were checked. None cover A2U incomplete authentication after `GHSA-f292-66h9-fpmf`.",
  "id": "GHSA-jxcw-qp4h-6jfq",
  "modified": "2026-07-20T21:31:16Z",
  "published": "2026-06-18T14:27:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jxcw-qp4h-6jfq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default"
}

PYSEC-2026-3515

Vulnerability from pysec - Published: 2026-07-23 11:41 - Updated: 2026-07-23 14:32

Details

Summary

praisonai serve a2u --host 0.0.0.0 --port 8002

This is an incomplete-fix report for the published A2U issue, not a separate trust-model-only concern.

Technical Details

The Typer command for A2U accepts only --host and --port:

src/praisonai/praisonai/cli/commands/serve.py:570-585

It forwards only those values to the shared serve handler:

args = ["a2u", "--host", host, "--port", str(port)]

The serve handler for A2U likewise accepts only host and port, then creates the app:

src/praisonai/praisonai/cli/features/serve.py:802-817

_create_a2u_app() registers A2U routes directly:

src/praisonai/praisonai/cli/features/serve.py:827-853

No call to _install_api_key_middleware(app, ...) is made for the dedicated A2U server, unlike the unified server path.

Inside create_a2u_routes(), auth is opt-in:

src/praisonai/praisonai/endpoints/a2u_server.py:245-253

auth_token = os.environ.get("A2U_AUTH_TOKEN")
if not auth_token:
    # No token configured - auth disabled (development mode)
    return None

The route helper then registers the same sensitive endpoints from the public advisory:

src/praisonai/praisonai/endpoints/a2u_server.py:391-409

Why This Is Not Intended Behavior

PoV

Run:

python3 poc/pov_poc.py \
  --repo /path/to/PraisonAI \
  --json

Observed current-head output:

{
  "no_token": {
    "info_status_no_auth": 200,
    "subscribe_status_no_auth": 200,
    "health_status_no_auth": 200,
    "subscribe_body": {
      "stream_name": "events",
      "stream_url": "http://testserver/a2u/events/sub-d8ee868a5491"
    }
  },
  "with_token": {
    "info_status_no_auth": 401,
    "subscribe_status_no_auth": 401,
    "info_with_token": 200,
    "subscribe_with_token": 200
  },
  "vulnerable_current_default": true
}

PoC

The PoV section above contains the local reproduction command, input, and decisive output.

Impact

If operators rely on the published fixed version or the secure-by-default serve documentation, they may expose A2U on a network interface believing the unauthenticated stream issue is fixed.

Severity

Suggested severity: High.

Suggested Fix

Recommended:

Make praisonai serve a2u secure by default in the same way as the documented API servers: generate a bearer token when none is configured, print it to stderr, and enforce it on all non-public A2U endpoints.
Add --api-key / --auth-token support to the dedicated A2U command and pass the configured token into create_a2u_routes() or shared middleware.
Fail closed for external binds such as --host 0.0.0.0 unless authentication is enabled.
Require auth on /a2u/health or remove subscription and stream counts from unauthenticated health responses.
Add regression tests for praisonai serve a2u proving unauthenticated /a2u/subscribe returns 401 on current/fixed versions by default.

Affected Package/Versions

Repository: MervinPraison/PraisonAI
Ecosystem: pip
Package: praisonai
Component: A2U Agent-to-User event stream server
Current checkout validated: 2f9677abb2ea68eab864ee8b6a828fd0141612e1
Current checkout tag state: v4.6.57-4-g2f9677ab
Public prior advisory: GHSA-f292-66h9-fpmf, fixed range claims praisonai <= 4.5.114

Suggested affected range:

pip:praisonai >= 4.5.115, <= 4.6.58

Advisory History

Visible PraisonAI advisories and prior submissions were checked. None cover A2U incomplete authentication after GHSA-f292-66h9-fpmf.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Impacted products

Name	purl
praisonai	pkg:pypi/praisonai

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai",
        "purl": "pkg:pypi/praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.5.115"
            },
            {
              "fixed": "4.6.61"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.5.115",
        "4.5.117",
        "4.5.118",
        "4.5.119",
        "4.5.120",
        "4.5.121",
        "4.5.122",
        "4.5.123",
        "4.5.124",
        "4.5.125",
        "4.5.126",
        "4.5.127",
        "4.5.128",
        "4.5.129",
        "4.5.130",
        "4.5.131",
        "4.5.132",
        "4.5.133",
        "4.5.134",
        "4.5.135",
        "4.5.136",
        "4.5.137",
        "4.5.139",
        "4.5.140",
        "4.5.143",
        "4.5.144",
        "4.5.145",
        "4.5.149",
        "4.6.10",
        "4.6.11",
        "4.6.12",
        "4.6.13",
        "4.6.14",
        "4.6.15",
        "4.6.16",
        "4.6.18",
        "4.6.19",
        "4.6.20",
        "4.6.21",
        "4.6.22",
        "4.6.23",
        "4.6.24",
        "4.6.25",
        "4.6.26",
        "4.6.27",
        "4.6.28",
        "4.6.29",
        "4.6.30",
        "4.6.31",
        "4.6.32",
        "4.6.33",
        "4.6.34",
        "4.6.35",
        "4.6.36",
        "4.6.37",
        "4.6.38",
        "4.6.39",
        "4.6.40",
        "4.6.41",
        "4.6.42",
        "4.6.43",
        "4.6.44",
        "4.6.45",
        "4.6.46",
        "4.6.47",
        "4.6.48",
        "4.6.50",
        "4.6.51",
        "4.6.52",
        "4.6.53",
        "4.6.54",
        "4.6.55",
        "4.6.56",
        "4.6.57",
        "4.6.58",
        "4.6.59",
        "4.6.60",
        "4.6.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57146",
    "GHSA-jxcw-qp4h-6jfq"
  ],
  "details": "## Summary\n\nThe published A2U advisory `GHSA-f292-66h9-fpmf` says unauthenticated A2U event streaming was fixed in `praisonai` `4.5.115`. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint:\n\n```text\npraisonai serve a2u --host 0.0.0.0 --port 8002\n```\n\nThe current CLI wrapper does not expose `--api-key`, does not install the common API-key middleware, and does not generate a token for A2U. It calls `create_a2u_routes(app)` directly. That helper only enforces auth if `A2U_AUTH_TOKEN` is already present; if the variable is missing, `_authenticate_request()` returns `None` and treats auth as disabled.\n\nThis is an incomplete-fix report for the published A2U issue, not a separate trust-model-only concern.\n\n## Technical Details\n\nThe Typer command for A2U accepts only `--host` and `--port`:\n\n```text\nsrc/praisonai/praisonai/cli/commands/serve.py:570-585\n```\n\nIt forwards only those values to the shared serve handler:\n\n```python\nargs = [\"a2u\", \"--host\", host, \"--port\", str(port)]\n```\n\nThe serve handler for A2U likewise accepts only `host` and `port`, then creates the app:\n\n```text\nsrc/praisonai/praisonai/cli/features/serve.py:802-817\n```\n\n`_create_a2u_app()` registers A2U routes directly:\n\n```text\nsrc/praisonai/praisonai/cli/features/serve.py:827-853\n```\n\nNo call to `_install_api_key_middleware(app, ...)` is made for the dedicated A2U server, unlike the unified server path.\n\nInside `create_a2u_routes()`, auth is opt-in:\n\n```text\nsrc/praisonai/praisonai/endpoints/a2u_server.py:245-253\n```\n\n```python\nauth_token = os.environ.get(\"A2U_AUTH_TOKEN\")\nif not auth_token:\n    # No token configured - auth disabled (development mode)\n    return None\n```\n\nThe route helper then registers the same sensitive endpoints from the public advisory:\n\n```text\nsrc/praisonai/praisonai/endpoints/a2u_server.py:391-409\n```\n\n### Why This Is Not Intended Behavior\n\nThe public advisory for `GHSA-f292-66h9-fpmf` describes unauthenticated `/a2u/info`, `/a2u/subscribe`, `/a2u/events/{stream_name}`, `/a2u/events/sub/{id}`, and `/a2u/health` as the vulnerability and lists `4.5.115` as patched.\n\nCurrent documentation also says PraisonAI API servers are now secure by default, bind to `127.0.0.1`, and generate a bearer token if no token is provided. The dedicated A2U command does not implement that secure-by-default behavior. It remains unauthenticated unless a different environment variable, `A2U_AUTH_TOKEN`, was set before startup.\n\nThis report does not claim that explicit local-only development mode is always a vulnerability. The issue is the mismatch between the published fixed version / secure-by-default posture and the current A2U CLI behavior, including external binding via `--host 0.0.0.0`.\n\n## PoV\n\nRun:\n\n```bash\npython3 poc/pov_poc.py \\\n  --repo /path/to/PraisonAI \\\n  --json\n```\n\nObserved current-head output:\n\n```json\n{\n  \"no_token\": {\n    \"info_status_no_auth\": 200,\n    \"subscribe_status_no_auth\": 200,\n    \"health_status_no_auth\": 200,\n    \"subscribe_body\": {\n      \"stream_name\": \"events\",\n      \"stream_url\": \"http://testserver/a2u/events/sub-d8ee868a5491\"\n    }\n  },\n  \"with_token\": {\n    \"info_status_no_auth\": 401,\n    \"subscribe_status_no_auth\": 401,\n    \"info_with_token\": 200,\n    \"subscribe_with_token\": 200\n  },\n  \"vulnerable_current_default\": true\n}\n```\n\nThe PoV is local-only. It uses a small Starlette response/route shim so it can invoke the registered A2U handlers without starting a network listener or installing dependencies. The control shows that the route-level token check works when `A2U_AUTH_TOKEN` is configured; the vulnerable behavior is that the current documented CLI path does not require or generate that token.\n\n## PoC\n\nThe PoV section above contains the local reproduction command, input, and decisive output.\n\n## Impact\n\nAn attacker who can reach a current A2U server started without `A2U_AUTH_TOKEN` can subscribe to agent event streams without credentials. The prior public advisory already classifies the exposed data as agent responses, tool calls, thinking/progress events, and stream metadata.\n\nIf operators rely on the published fixed version or the secure-by-default serve documentation, they may expose A2U on a network interface believing the unauthenticated stream issue is fixed.\n\n### Severity\n\nSuggested severity: High.\n\n## Suggested Fix\n\nRecommended:\n\n1. Make `praisonai serve a2u` secure by default in the same way as the documented API servers: generate a bearer token when none is configured, print it to stderr, and enforce it on all non-public A2U endpoints.\n2. Add `--api-key` / `--auth-token` support to the dedicated A2U command and pass the configured token into `create_a2u_routes()` or shared middleware.\n3. Fail closed for external binds such as `--host 0.0.0.0` unless authentication is enabled.\n4. Require auth on `/a2u/health` or remove subscription and stream counts from unauthenticated health responses.\n5. Add regression tests for `praisonai serve a2u` proving unauthenticated `/a2u/subscribe` returns `401` on current/fixed versions by default.\n\n## Affected Package/Versions\n\n- Repository: `MervinPraison/PraisonAI`\n- Ecosystem: `pip`\n- Package: `praisonai`\n- Component: A2U Agent-to-User event stream server\n- Current checkout validated: `2f9677abb2ea68eab864ee8b6a828fd0141612e1`\n- Current checkout tag state: `v4.6.57-4-g2f9677ab`\n- Public prior advisory: `GHSA-f292-66h9-fpmf`, fixed range claims `praisonai \u003c= 4.5.114`\n\nSuggested affected range:\n\n```text\npip:praisonai \u003e= 4.5.115, \u003c= 4.6.58\n```\n\nIf maintainers prefer to update the public advisory rather than create a new advisory, the important correction is that the fixed version/range should not mark the current `praisonai serve a2u` behavior as fixed.\n\n## Advisory History\n\nThis is intentionally adjacent to `GHSA-f292-66h9-fpmf`. The report-grade point is that current versions after the claimed patched version still reproduce the same default unauthenticated A2U behavior through the maintained CLI entrypoint.\n\nVisible PraisonAI advisories and prior submissions were checked. None cover A2U incomplete authentication after `GHSA-f292-66h9-fpmf`.",
  "id": "PYSEC-2026-3515",
  "modified": "2026-07-23T14:32:31.460976Z",
  "published": "2026-07-23T11:41:42.974600Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jxcw-qp4h-6jfq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/praisonai"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-jxcw-qp4h-6jfq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57146"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-57146 (GCVE-0-2026-57146)

FKIE_CVE-2026-57146

GHSA-JXCW-QP4H-6JFQ

Summary

Technical Details

Why This Is Not Intended Behavior

PoV

PoC

Impact

Severity

Suggested Fix

Affected Package/Versions

Advisory History

PYSEC-2026-3515

Summary

Technical Details

Why This Is Not Intended Behavior

PoV

PoC

Impact

Severity

Suggested Fix

Affected Package/Versions

Advisory History

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour