EUVD-2026-65497
GHSA-7g3p-92qq-8wvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover network-exposed AgentServer port
-
DeliverySend unauthenticated HTTP request to any route
-
ExploitBypass absent authentication check
-
ExecutionPOST crafted payload to /publish
-
PersistInject arbitrary instructions into multi-agent pipeline
-
ImpactExfiltrate agent outputs via /events SSE stream
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network reachability of the AgentServer instance - the bypass applies unconditionally to all routes (/info, /publish, /events, /health) regardless of whether auth_token is set in ServerConfig. CVSS PR:N confirms unauthenticated access is sufficient. The primary factor limiting exploitation is network exposure: instances bound exclusively to localhost (127.0.0.1) or isolated behind a firewall are not reachable by external attackers. There is no required user interaction, no non-default configuration to enable the vulnerability (it is present in all deployments of vulnerable versions), and no platform or OS constraint. Operators who intentionally configured auth_token have no runtime signal that it is not being enforced. |
| Impact | CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) accurately reflects the severity: network-reachable, zero authentication required, no user interaction, and high integrity impact from unrestricted agent pipeline injection. The high integrity score is well-founded - unauthenticated callers can publish arbitrary payloads to multi-agent workflows, potentially hijacking task execution or poisoning agent state. The low confidentiality score reflects /info metadata exposure rather than full data access. No EPSS data was provided in the intelligence feed, and this CVE is not listed in CISA KEV, so active exploitation is not confirmed - the real-world risk is elevated primarily by the deceptive /info behavior: operators who configure auth_token receive no runtime warning that it is not enforced, meaning affected deployments are silently unprotected. Any operator who has relied on the auth_token configuration as a security control should treat this as immediately actionable, as their deployment perimeter is wider than assumed. |
| Exploit ScenarioDerived | An unauthenticated remote attacker scans for network-exposed PraisonAI AgentServer instances and, regardless of any auth_token the operator configured, sends a standard HTTP POST to the /publish endpoint with a crafted payload, injecting arbitrary instructions into active multi-agent workflows. The attacker simultaneously subscribes to /events via a long-lived SSE connection to monitor agent outputs and exfiltrate task results. No specialized tooling or credentials are needed - only HTTP access to the exposed port. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to unauthenticated remote callers, even when operators have explicitly configured an auth_token in ServerConfig. The AgentServer._create_app factory never reads or enforces the configured token, rendering it dead code while /info actively misleads operators by displaying it as masked ('***'), creating a false sense of security. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV; the fix is confirmed in praisonaiagents 1.6.58.
RemediationAI
Upgrade praisonaiagents to version 1.6.58 or later via pip install --upgrade praisonaiagents. The fix, tracked in commit https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1 and release tag https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58, adds a _authorise_request() method that validates Authorization: Bearer <token> and X-Auth-Token headers against the configured auth_token on every route before processing the request. Until the patch is applied, operators should restrict network access to the AgentServer port via firewall rules or reverse-proxy authentication (e.g., nginx auth_basic or mTLS), limiting access to trusted source IPs only - note this trades off agent accessibility and may break legitimate integrations that expect unauthenticated internal access. Disabling the AgentServer component entirely is the most conservative interim control if the feature is not required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is praisonaiagents.server.AgentServer, a FastAPI-based HTTP and Server-Sent Events server bundled in the praisonaiagents PyPI package (CPE: cpe:2.3:a:mervinpraison:praisonaiagents:*:*:*:*:*:*:*:*). CWE-306 (Missing Authentication for Critical Function) precisely describes the root cause: ServerConfig declares auth_token as an Optional[str] field, and the /info route even confirms receipt by displaying '***', but _create_app never instantiates authentication middleware, never applies a FastAPI Depends() guard, and never reads request.headers['Authorization'] in any route handler. The same package contains a sibling server, praisonaiagents.ui.a2a.A2A, that implements the correct bearer-token pattern via a _verify_auth dependency injected through FastAPI's Depends() - confirming the developer was aware of the correct pattern and applied it selectively, making this a missing-implementation defect rather than a design gap.
Know when Praisonai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Network-accessible server with no authentication on any route; high integrity from unrestricted agent pipeline injection, low confidentiality from /info metadata leakage only.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.
Executive ViewAI
PraisonAI AgentServer contains a critical authentication bypass that leaves all API endpoints open to unauthenticated network access, even when administrators configure authentication tokens. This creates hidden operational exposure-configured security controls are silently ignored while appearing active-putting agent management interfaces and data at risk of unauthorized access or modification.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Exploit-DB