PraisonAI EUVD-2026-108900

Exploitation requires the operator to launch the dedicated A2U server via the CLI ('praisonai serve a2u') with the A2U_AUTH_TOKEN environment variable unset - in that state _authenticate_request() returns None and treats auth as disabled, because the A2U CLI path does not call _install_api_key_middleware() nor generate a bearer token, unlike the unified server path. Remote reachability additionally requires binding to an external interface (e.g. --host 0.0.0.0); a default loopback bind limits exposure to the local host. The exposed endpoints are /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health. The key limiting factor is that pre-setting A2U_AUTH_TOKEN before startup enables the route-level token check (the PoV shows 401 with a token configured), so this is a config-dependent default-off authentication gap rather than an unconditionally reachable flaw.

This is a genuine but conditional exposure rather than a mass-exploitation emergency. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5) describes unauthenticated network access with confidentiality-only impact, which is consistent with the advisory: anyone who can reach a running A2U server can subscribe to agent event streams without credentials. The vuln.today decision label is 'this_week' (not act_now/emergency), it is NOT listed in CISA KEV, and no EPSS score was provided, so there is no signal of active or widespread exploitation. The caveat that tempers the raw 7.5 is operator-dependent reachability: the flaw only becomes network-exploitable when the operator starts 'praisonai serve a2u' bound to an external interface (e.g. --host 0.0.0.0) AND without the A2U_AUTH_TOKEN environment variable set - the CLI neither generates a token nor installs the API-key middleware by default. A public PoV reference exists in the advisory but it is a local-only reproduction (a Starlette shim), so it demonstrates the missing auth check rather than a verified remote weaponized exploit. Net: a real priority for anyone exposing A2U on a network, but the PR:N network vector presumes an externally bound deployment that is not the secure-by-default posture the project documents elsewhere.

An operator runs 'praisonai serve a2u --host 0.0.0.0 --port 8002' believing the published A2U fix (GHSA-f292-66h9-fpmf, 4.5.115) and the secure-by-default documentation protect it, but A2U_AUTH_TOKEN is unset so authentication is silently disabled. A remote attacker who can reach the port issues an unauthenticated POST to /a2u/subscribe and GETs the returned event stream, reading agent responses, tool calls, thinking/progress events, and stream metadata. A local-only PoV in the advisory confirms /a2u/info, /a2u/subscribe, and /a2u/health return 200 without a token on current head.