{"id":"CVE-2026-57146","kind":"vulnerability","aliases":["CVE-2026-57146"],"related":[],"title":"PraisonAI: unauthenticated A2U event routes expose agent event streams","description":"PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.","summary":"PraisonAI's CLI starts the A2U subscription and event routes without authentication unless the A2U_AUTH_TOKEN variable is set, because the auth check treats a missing token as disabled. An attacker who can reach the server can subscribe to and read agent event streams.","severity":"high","cvss":7.5,"epss":0.00485,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","praisonai","python"],"not_affected_if":["auth-required","local-only-binding"],"how_to_check":"- Run `praisonai --version` and confirm whether it is between `4.5.115` and `4.6.61`.\n- Check whether `A2U_AUTH_TOKEN` is set in the environment where the CLI server runs, for example `printenv A2U_AUTH_TOKEN`.\n- Confirm whether the A2U routes are reachable from outside the host by requesting the A2U subscription endpoint without credentials.","fix":"- Upgrade PraisonAI to `4.6.61` or later.\n- Until upgraded, set `A2U_AUTH_TOKEN` to a strong secret so the auth check is enforced, and restrict network access to the server.","status":"open","published_at":"2026-10-23T13:17:11+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T03:14:54+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:14:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PraisonAI to `4.6.61` or later.\n- Until upgraded, set `A2U_AUTH_TOKEN` to a strong secret so the auth check is enforced, and restrict network access to the server.","reach":"network","title":"PraisonAI: unauthenticated A2U event routes expose agent event streams","impact":"medium","summary":"PraisonAI's CLI starts the A2U subscription and event routes without authentication unless the A2U_AUTH_TOKEN variable is set, because the auth check treats a missing token as disabled. An attacker who can reach the server can subscribe to and read agent event streams.","category":"ai-tooling","nicknames":[],"who_cares":["praisonai","ai-agents","python"],"confidence":0.7,"needs_auth":"no","worst_case":"unauthenticated users read agent event streams from the server","analyst_note":"Check GHSA-f292-66h9-fpmf and the praisonai 4.6.61 release notes for exact default binding and which event data is exposed.","how_to_check":"- Run `praisonai --version` and confirm whether it is between `4.5.115` and `4.6.61`.\n- Check whether `A2U_AUTH_TOKEN` is set in the environment where the CLI server runs, for example `printenv A2U_AUTH_TOKEN`.\n- Confirm whether the A2U routes are reachable from outside the host by requesting the A2U subscription endpoint without credentials.","needs_analyst":true,"not_affected_if":["auth-required","local-only-binding"],"who_is_affected":"Teams that run the PraisonAI CLI entrypoint with A2U routes enabled and reachable over a network are exposed, because the wrapper does not install API-key middleware and the route helper skips auth when no token variable is present. Deployments that set A2U_AUTH_TOKEN or keep the server bound to localhost are less exposed. Teams not running PraisonAI can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":3458,"output_tokens":707,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-57146':12A,15A '4.5.115':79C,102C '4.6.61':83C,191C '66h9':91C 'a2u':3A,29B,38B,86C,95C,109C,150C,154C,164C 'advisori':87C 'agent':7A,18B,66B,74C 'ai':17B,20B 'ai-ag':16B 'ai-tool':19B 'alreadi':168C 'api':132C,140C 'api-key':131C,139C 'app':156C 'attack':55B 'auth':39B,46B,162C,165C,181C 'authent':35B,115C,175C 'call':152C 'check':47B 'cli':26B,122C,126C 'common':138C 'creat':153C 'current':103C,125C 'cve':10A,13A 'direct':157C 'disabl':53B,183C 'document':121C 'enforc':161C 'entrypoint':123C 'event':4A,8A,32B,67B,96C,112C 'expos':6A,106C,130C 'f292':90C 'fix':99C 'fpmf':92C 'generat':146C 'ghsa':89C 'ghsa-f292-66h9-fpmf':88C 'head':104C 'helper':159C 'instal':136C 'issu':185C 'key':133C,141C 'middlewar':142C 'miss':50B,174C 'multi':73C 'multi-ag':72C 'none':178C 'oper':118C 'patch':188C 'praisonai':1A,22B,24B,69C,101C 'present':169C 'publish':85C 'python':23B 'reach':58B 'read':65B 'request':176C 'return':177C 'rout':5A,33B,113C,155C 'say':93C 'server':60B 'set':43B 'start':27B,119C 'still':105C 'stream':9A,68B,97C 'subscrib':62B 'subscript':30B,110C 'system':76C 'team':75C 'token':40B,51B,148C,166C 'tool':21B 'treat':48B,180C 'unauthent':2A,94C 'unless':36B 'variabl':41B,172C 'version':78C,82C,190C 'without':34B,114C 'wrapper':127C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the PraisonAI CLI entrypoint with A2U routes enabled and reachable over a network are exposed, because the wrapper does not install API-key middleware and the route helper skips auth when no token variable is present. Deployments that set A2U_AUTH_TOKEN or keep the server bound to localhost are less exposed. Teams not running PraisonAI can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57146","severity":null,"published_at":"2026-10-23T13:17:11+00:00","modified_at":"2026-10-23T13:17:11+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-57146","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-57146","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}