AI Threat AlertCVE-2026-57146: PraisonAI: unauthenticated A2U event streaming exposed
HIGHPraisonAI's CLI starts its A2U (agent-to-UI) subscription and event routes with no authentication unless the operator has manually set A2U_AUTH_TOKEN. This is an incomplete fix for an earlier advisory, so deployments that updated to 4.5.115 believing the issue was closed are still exposed. The flaw is network-reachable, needs no privileges or user interaction, and gives an attacker high-confidentiality access to agent event streams, which can contain prompts, tool outputs, and data the agents handle. There is no CISA KEV listing, no public exploit, no Nuclei template, and no EPSS score yet, so mass exploitation isn't evidenced today. Exposure is easy to test and the exploit is trivial, so treat it as a priority for any internet- or network-exposed PraisonAI instance. Upgrade to 4.6.61 or later, and until then set a strong A2U_AUTH_TOKEN and restrict network access to the A2U port.
What is the risk?
High (CVSS 7.5), confidentiality impact only. Exploitation is trivial: an unauthenticated network request to the A2U subscription or event routes. There is no evidence of active exploitation, no public exploit, no KEV listing, and EPSS is unavailable. Real-world risk depends on exposure: instances bound to 0.0.0.0 or published behind a reverse proxy are at highest risk, while loopback-only deployments are much less exposed. Because the earlier fix (4.5.115) appeared to resolve this, teams may wrongly believe they are protected, which raises residual risk. The weaknesses are CWE-306 (missing authentication) and CWE-200 (information exposure).
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | — | No patch |
Do you use PraisonAI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade PraisonAI to 4.6.61 or later. 2) Until patched, set a strong random A2U_AUTH_TOKEN in the environment before starting the CLI, because create_a2u_routes only enforces auth when the variable is present. 3) Bind the service to localhost or a private interface and place it behind an authenticating reverse proxy, VPN, or firewall rules. 4) Confirm that A2U routes return 401/403 without a token. 5) Review access logs for unauthenticated requests to A2U subscription and event routes and for unexpected long-lived streaming connections. 6) If exposure is found, rotate any secrets, API keys, or tokens that agents may have emitted through events, and review the data agents handled. 7) Add a startup check to fail closed when A2U_AUTH_TOKEN is missing.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-57146?
PraisonAI's CLI starts its A2U (agent-to-UI) subscription and event routes with no authentication unless the operator has manually set A2U_AUTH_TOKEN. This is an incomplete fix for an earlier advisory, so deployments that updated to 4.5.115 believing the issue was closed are still exposed. The flaw is network-reachable, needs no privileges or user interaction, and gives an attacker high-confidentiality access to agent event streams, which can contain prompts, tool outputs, and data the agents handle. There is no CISA KEV listing, no public exploit, no Nuclei template, and no EPSS score yet, so mass exploitation isn't evidenced today. Exposure is easy to test and the exploit is trivial, so treat it as a priority for any internet- or network-exposed PraisonAI instance. Upgrade to 4.6.61 or later, and until then set a strong A2U_AUTH_TOKEN and restrict network access to the A2U port.
Is CVE-2026-57146 actively exploited?
No confirmed active exploitation of CVE-2026-57146 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-57146?
1) Upgrade PraisonAI to 4.6.61 or later. 2) Until patched, set a strong random A2U_AUTH_TOKEN in the environment before starting the CLI, because create_a2u_routes only enforces auth when the variable is present. 3) Bind the service to localhost or a private interface and place it behind an authenticating reverse proxy, VPN, or firewall rules. 4) Confirm that A2U routes return 401/403 without a token. 5) Review access logs for unauthenticated requests to A2U subscription and event routes and for unexpected long-lived streaming connections. 6) If exposure is found, rotate any secrets, API keys, or tokens that agents may have emitted through events, and review the data agents handled. 7) Add a startup check to fail closed when A2U_AUTH_TOKEN is missing.
What systems are affected by CVE-2026-57146?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, agent-to-UI event streaming, agent orchestration.
What is the CVSS score for CVE-2026-57146?
CVE-2026-57146 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.49%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0036Data from Information RepositoriesAML.T0049Exploit Public-Facing ApplicationAML.T0085.001AI Agent ToolsCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.
Exploitation Scenario
An attacker scans for exposed PraisonAI deployments, or finds one on an internal network after gaining a foothold. They send an unauthenticated request to the A2U subscription route and open an event stream. Because the CLI wrapper never installs auth middleware or generates a token, and the helper treats a missing A2U_AUTH_TOKEN as auth disabled, the server accepts the connection. The attacker passively collects agent events as they run, including user prompts, tool call results, and internal data, and may harvest credentials that appear in tool output to use for follow-on access.
Weaknesses (CWE)
CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimaryCWE-306Missing Authentication for Critical FunctionPrimaryCWE-200Exposure of Sensitive Information to an Unauthorized ActorCWE-306Missing Authentication for Critical FunctionCWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NTimeline
Related Vulnerabilities
CVE-2026-4816810.0PraisonAI: shell injection in Claude Action enables RCE
Same package: praisonaiCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiCVE-2026-614459.9PraisonAI: AICoder root RCE via unsanitized tool calls
Same package: praisonaiGHSA-vmmj-pfw7-fjwp9.9praisonai: sandbox escape gives RCE via codeMode tool
Same package: praisonaiCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonai