CVE-2026-55528: PraisonAI Agents AgentServer auth

CISO Take

PraisonAI's AgentServer ships a configurable bearer/X-Auth-Token mechanism that its route handlers simply never check, so any remote, unauthenticated caller can subscribe to and publish on the agent's pub/sub channels and trigger the same actions a legitimate authenticated client would. This matters because AgentServer sits at the center of PraisonAI's multi-agent orchestration and is exposed over the network with no complexity barrier (CVSS 8.2, AV:N/AC:L/PR:N/UI:N) — 20 known downstream projects depend on praisonaiagents, and the package already carries 60 other CVEs and a package risk score of 0/100, a weak security track record worth weighing in any vendor risk decision. There is no evidence of active exploitation (not in CISA KEV, no EPSS score, no public PoC or Nuclei template yet), but the exploitation bar is trivial — a bare unauthenticated request — so the lack of telemetry should not be mistaken for low risk. Patch to praisonaiagents >= 1.6.58 immediately on any internet-facing or shared-network deployment; until patched, treat AgentServer as unauthenticated, restrict it to a trusted network segment or front it with an authenticating reverse proxy, and audit logs for subscribe/publish calls missing a valid Authorization or X-Auth-Token header as a sign of exploitation attempts.

Sources:NVDGitHub AdvisoryCISA KEVATLAS

What is the risk?

HIGH. Exploitability is effectively trivial: network-reachable, no authentication complexity, no user interaction, and no valid credentials required — the auth_token exists but is dead code in the route layer (CWE-306/CWE-862). Impact is asymmetric across the CIA triad: integrity is high (an unauthenticated caller can publish messages agents will act on, i.e. hijack agent behavior) while confidentiality is low and availability is unaffected, per the CVSS vector (C:L/I:H/A:N). No active exploitation signal exists today (not in CISA KEV, no EPSS score, no public exploit or Nuclei template), which caps near-term urgency versus KEV-listed flaws, but the combination of zero exploitation cost and a package with a poor track record (60 prior CVEs, 0/100 risk score) makes this a high-priority patch rather than a monitor-and-wait item, especially for any AgentServer instance reachable from outside a trusted network.

How does the attack unfold?

Reconnaissance

Attacker discovers an internet-facing PraisonAI AgentServer instance exposed on the network.

AML.T0006

Exploitation

Attacker sends requests to AgentServer routes without a bearer token or X-Auth-Token header, bypassing the unenforced authentication check.

AML.T0049

Agent action abuse

Attacker subscribes to and publishes on the agent's pub/sub channels, invoking actions as if fully authenticated.

AML.T0053

Impact

Attacker manipulates or hijacks the multi-agent team's task flow and outputs, or reads data flowing through the channel, without ever holding valid credentials.

AML.T0108

Reconnaissance

Attacker discovers an internet-facing PraisonAI AgentServer instance exposed on the network.

AML.T0006

Exploitation

Attacker sends requests to AgentServer routes without a bearer token or X-Auth-Token header, bypassing the unenforced authentication check.

AML.T0049

Agent action abuse

Attacker subscribes to and publishes on the agent's pub/sub channels, invoking actions as if fully authenticated.

AML.T0053

Impact

Attacker manipulates or hijacks the multi-agent team's task flow and outputs, or reads data flowing through the channel, without ever holding valid credentials.

AML.T0108

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI Agents	pip	< 1.6.58	`1.6.58`
20 dependents63% patched~21d to patchFull package profile →

Do you use PraisonAI Agents? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

IHigh

ANone

What should I do?

1 step

1) Upgrade to praisonaiagents >= 1.6.58, which enforces the auth_token check on AgentServer routes. 2) Until patched, do not expose AgentServer to untrusted networks — restrict access via firewall/security-group rules to known trusted IPs, or place it behind a reverse proxy that enforces its own authentication (basic auth, mTLS, or an API gateway with token validation) independent of the app-layer check. 3) After patching, rotate any existing auth_token values, since they were never actually validated and should be treated as potentially exposed. 4) Add detection: alert on subscribe/publish requests to AgentServer endpoints missing a valid Authorization/X-Auth-Token header, and review recent access logs for anomalous pub/sub activity predating the patch. 5) Where feasible, run AgentServer with network-level isolation (private subnet, no public ingress) as defense in depth regardless of patch status.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAgentAPIAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0108- AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.1-Operational planning and control

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-55528?

PraisonAI's AgentServer ships a configurable bearer/X-Auth-Token mechanism that its route handlers simply never check, so any remote, unauthenticated caller can subscribe to and publish on the agent's pub/sub channels and trigger the same actions a legitimate authenticated client would. This matters because AgentServer sits at the center of PraisonAI's multi-agent orchestration and is exposed over the network with no complexity barrier (CVSS 8.2, AV:N/AC:L/PR:N/UI:N) — 20 known downstream projects depend on praisonaiagents, and the package already carries 60 other CVEs and a package risk score of 0/100, a weak security track record worth weighing in any vendor risk decision. There is no evidence of active exploitation (not in CISA KEV, no EPSS score, no public PoC or Nuclei template yet), but the exploitation bar is trivial — a bare unauthenticated request — so the lack of telemetry should not be mistaken for low risk. Patch to praisonaiagents >= 1.6.58 immediately on any internet-facing or shared-network deployment; until patched, treat AgentServer as unauthenticated, restrict it to a trusted network segment or front it with an authenticating reverse proxy, and audit logs for subscribe/publish calls missing a valid Authorization or X-Auth-Token header as a sign of exploitation attempts.

Is CVE-2026-55528 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55528, increasing the risk of exploitation.

How to fix CVE-2026-55528?

1) Upgrade to praisonaiagents >= 1.6.58, which enforces the auth_token check on AgentServer routes. 2) Until patched, do not expose AgentServer to untrusted networks — restrict access via firewall/security-group rules to known trusted IPs, or place it behind a reverse proxy that enforces its own authentication (basic auth, mTLS, or an API gateway with token validation) independent of the app-layer check. 3) After patching, rotate any existing auth_token values, since they were never actually validated and should be treated as potentially exposed. 4) Add detection: alert on subscribe/publish requests to AgentServer endpoints missing a valid Authorization/X-Auth-Token header, and review recent access logs for anomalous pub/sub activity predating the patch. 5) Where feasible, run AgentServer with network-level isolation (private subnet, no public ingress) as defense in depth regardless of patch status.

What systems are affected by CVE-2026-55528?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI agent APIs.

What is the CVSS score for CVE-2026-55528?

CVE-2026-55528 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.49%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationAI agent APIs

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0108AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.1

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.

Exploitation Scenario

An attacker scans for internet-facing PraisonAI deployments and identifies an exposed AgentServer HTTP endpoint. Without supplying any bearer token or X-Auth-Token header, they send a subscribe request and successfully receive the agent event stream — confirming the auth check is not enforced. They then publish a crafted message onto the channel that legitimate agents are configured to trust and act on, effectively injecting unauthorized instructions into the multi-agent workflow (e.g., redirecting a task, exfiltrating intermediate agent outputs, or corrupting downstream results) — all without ever presenting valid credentials, since the vulnerable code path never checks for them.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionPrimary CWE-306Missing Authentication for Critical FunctionPrimary CWE-862Missing AuthorizationPrimary CWE-862Missing AuthorizationPrimary CWE-306Missing Authentication for Critical Function CWE-862Missing Authorization

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.