Executive brief
PraisonAI, a platform for managing teams of AI agents, contains a security flaw in its Agent-to-User (A2U) communication component. This flaw allows anyone with network access to monitor all AI agent activity in real-time without needing a password. An attacker could view sensitive information, including the AI's internal reasoning, the specific tools it uses, and the final responses provided to legitimate users, potentially exposing proprietary business logic or private data.
Technical details
The A2U (Agent-to-User) event stream server in PraisonAI fails to implement authentication checks on several critical endpoints. Specifically, the `create_a2u_routes()` function registers endpoints such as `/a2u/subscribe` and `/a2u/events/{stream_name}` without any authorization requirements. A remote, unauthenticated attacker can subscribe to these Server-Sent Events (SSE) streams to receive real-time data including `agent.thinking`, `agent.tool_call`, and `agent.response` events. This leads to the exposure of sensitive agent interactions and internal reasoning processes. The issue is resolved in version 4.5.115.
Affected products
- MervinPraison PraisonAI < 4.5.115
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-04-08: disclosed: CVE published to NVD
- 2026-04-08: patched: Fix released in version 4.5.115