CVE-2026-57128: PraisonAI Agents SSE server auth

CISO Take

The SSE server in praisonaiagents skips its own auth_token check for the /publish, /events, and /info endpoints, so any client that can reach the service over the network can pull server configuration and connected-client counts and broadcast arbitrary spoofed events to every connected client. This is a trivial, no-authentication, no-user-interaction bypass (CVSS 4.3, AC:L/PR:N/UI:N) that only requires adjacent network reach, which is common in shared VPCs, Kubernetes namespaces, or internal LANs where PraisonAI multi-agent deployments typically run. There is no CISA KEV listing, no public exploit code, and no EPSS data, so opportunistic mass exploitation is unlikely today — but the fix is a one-line dependency bump, making remediation cheap relative to leaving an unauthenticated control-plane endpoint exposed. Upgrade to praisonaiagents 1.6.58 or later immediately; until patched, restrict network access to the SSE server to trusted hosts only and treat any unexpected traffic to /publish or /info as a detection signal.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Confidentiality and integrity impact are both capped at low/none per the CVSS vector (C:N/I:L/A:N), reflecting that the flaw leaks operational metadata (config, client count) and allows event spoofing rather than data exfiltration or full compromise. Exploitability is high in relative terms: no privileges, no user interaction, low attack complexity, and a fully unauthenticated code path — the only real barrier is achieving adjacent network access to the server. In multi-tenant or shared-network agent deployments this barrier is often weaker than assumed, so the practical risk is higher than the raw CVSS score suggests, especially where the SSE channel is trusted implicitly by downstream orchestration logic.

How does the attack unfold?

Network Reconnaissance

Attacker on the adjacent network locates the exposed PraisonAI SSE server and queries the unauthenticated /info endpoint to learn server configuration and connected-client count.

AML.T0084

Unauthenticated Access

Because ServerConfig.auth_token is never checked for /publish, /events, or /info, the attacker interacts with these endpoints without any credentials.

AML.T0049

Event Injection

Attacker sends crafted requests to /publish, broadcasting arbitrary spoofed events to all clients subscribed via /events.

AML.T0080.001

Downstream Impact

Connected multi-agent clients and operators treat the spoofed events as legitimate, potentially disrupting agent coordination or misleading monitoring.

Network Reconnaissance

Attacker on the adjacent network locates the exposed PraisonAI SSE server and queries the unauthenticated /info endpoint to learn server configuration and connected-client count.

AML.T0084

Unauthenticated Access

Because ServerConfig.auth_token is never checked for /publish, /events, or /info, the attacker interacts with these endpoints without any credentials.

AML.T0049

Event Injection

Attacker sends crafted requests to /publish, broadcasting arbitrary spoofed events to all clients subscribed via /events.

AML.T0080.001

Downstream Impact

Connected multi-agent clients and operators treat the spoofed events as legitimate, potentially disrupting agent coordination or misleading monitoring.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI Agents	pip	—	No patch
20 dependents 59% patched ~6d to patch Full package profile →

Do you use PraisonAI Agents? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Adjacent

AC Low

PR None

UI None

S Unchanged

C None

I Low

A None

What should I do?

1 step

Upgrade praisonaiagents to version 1.6.58 or later, which enforces ServerConfig.auth_token on /publish, /events, and /info. If immediate upgrade isn't possible, restrict network reachability to the SSE server (firewall rules, network policies, or binding to localhost/private interfaces only) so it is not reachable from adjacent hosts or shared network segments. Add monitoring/alerting for unexpected connections or POST requests to /publish and /info, and audit logs for anomalous event broadcasts that don't correlate with known agent activity.

How is it classified?

Auth Bypass Data Leakage Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0080.001 - Thread AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system operation and monitoring

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-57128?

The SSE server in praisonaiagents skips its own auth_token check for the /publish, /events, and /info endpoints, so any client that can reach the service over the network can pull server configuration and connected-client counts and broadcast arbitrary spoofed events to every connected client. This is a trivial, no-authentication, no-user-interaction bypass (CVSS 4.3, AC:L/PR:N/UI:N) that only requires adjacent network reach, which is common in shared VPCs, Kubernetes namespaces, or internal LANs where PraisonAI multi-agent deployments typically run. There is no CISA KEV listing, no public exploit code, and no EPSS data, so opportunistic mass exploitation is unlikely today — but the fix is a one-line dependency bump, making remediation cheap relative to leaving an unauthenticated control-plane endpoint exposed. Upgrade to praisonaiagents 1.6.58 or later immediately; until patched, restrict network access to the SSE server to trusted hosts only and treat any unexpected traffic to /publish or /info as a detection signal.

Is CVE-2026-57128 actively exploited?

No confirmed active exploitation of CVE-2026-57128 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57128?

Upgrade praisonaiagents to version 1.6.58 or later, which enforces ServerConfig.auth_token on /publish, /events, and /info. If immediate upgrade isn't possible, restrict network reachability to the SSE server (firewall rules, network policies, or binding to localhost/private interfaces only) so it is not reachable from adjacent hosts or shared network segments. Add monitoring/alerting for unexpected connections or POST requests to /publish and /info, and audit logs for anomalous event broadcasts that don't correlate with known agent activity.

What systems are affected by CVE-2026-57128?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, event-driven agent communication.

What is the CVSS score for CVE-2026-57128?

CVE-2026-57128 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.16%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationevent-driven agent communication

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0080.001 Thread

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast arbitrary events to connected clients and obtain server configuration and client-count information. This issue is fixed in praisonaiagents 1.6.58.

Exploitation Scenario

An attacker who has landed on the same network segment as a PraisonAI deployment — for example another container in a shared Kubernetes cluster, a compromised host on the same corporate VLAN, or a co-tenant in a misconfigured cloud VPC — first queries the unauthenticated /info endpoint to learn server configuration details and how many clients are currently connected. They then send crafted requests to /publish, broadcasting spoofed events to every client subscribed via /events. Downstream multi-agent components that trust the SSE stream as an internal, implicitly authenticated channel consume these forged events as legitimate, potentially disrupting agent coordination, misleading human operators watching the event stream, or triggering unintended workflow branches.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.