Live › vulnerability › CVE-2026-57146
Go to dashboardPraisonAI's CLI starts the A2U subscription and event routes without authentication unless the A2U_AUTH_TOKEN variable is set, because the auth check treats a missing token as disabled. An attacker who can reach the server can subscribe to and read agent event streams.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run the PraisonAI CLI entrypoint with A2U routes enabled and reachable over a network are exposed, because the wrapper does not install API-key middleware and the route helper skips auth when no token variable is present. Deployments that set A2U_AUTH_TOKEN or keep the server bound to localhost are less exposed. Teams not running PraisonAI can skip it.
No product ranges from the sources yet.
praisonai --version and confirm whether it is between 4.5.115 and 4.6.61.A2U_AUTH_TOKEN is set in the environment where the CLI server runs, for example printenv A2U_AUTH_TOKEN.4.6.61 or later.A2U_AUTH_TOKEN to a strong secret so the auth check is enforced, and restrict network access to the server.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.
This page as .md · .json · in your agent: get_signal("CVE-2026-57146")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.