---
id: "CVE-2026-57146"
kind: "vulnerability"
aliases: ["CVE-2026-57146"]
title: "PraisonAI: unauthenticated A2U event routes expose agent event streams"
severity: "high"
cvss: 7.5
epss: 0.00485
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "praisonai", "python"]
not_affected_if: ["auth-required", "local-only-binding"]
published_at: "2026-10-23T13:17:11+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57146", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-57146", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# PraisonAI: unauthenticated A2U event routes expose agent event streams

PraisonAI's CLI starts the A2U subscription and event routes without authentication unless the A2U_AUTH_TOKEN variable is set, because the auth check treats a missing token as disabled. An attacker who can reach the server can subscribe to and read agent event streams.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `praisonai --version` and confirm whether it is between `4.5.115` and `4.6.61`.
- Check whether `A2U_AUTH_TOKEN` is set in the environment where the CLI server runs, for example `printenv A2U_AUTH_TOKEN`.
- Confirm whether the A2U routes are reachable from outside the host by requesting the A2U subscription endpoint without credentials.

## Fix

- Upgrade PraisonAI to `4.6.61` or later.
- Until upgraded, set `A2U_AUTH_TOKEN` to a strong secret so the auth check is enforced, and restrict network access to the server.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57146
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-57146

## From the sources

PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_