Executive brief
PraisonAI's agent server includes a configuration option for authentication tokens, but this protection is not actually implemented in the code. An attacker on the network can send commands to agents, listen to all server events, and access server configuration without any credentials. This means organizations relying on the authentication setting for security have no actual protection.
Technical details
The vulnerability is an authentication bypass in `praisonaiagents.server.AgentServer`. The component's `ServerConfig` class defines an `auth_token: Optional[str]` field, and the `/info` endpoint displays it masked as "***" when configured, strongly implying bearer-token authentication is enforced. However, `AgentServer._create_app()` never reads the token, adds authentication middleware, or uses FastAPI `Depends()` guards—all routes are registered without any authorization checks. The same package's `A2A` server implements proper bearer-token validation via `_verify_auth()`, confirming the developer knew the pattern but did not apply it here. Attack vectors include: (1) injecting arbitrary events via `POST /publish` to all subscribed agents; (2) eavesdropping on all agent observations, plans, and prompts via `GET /events`; (3) leaking CORS origins and confirming high-value targets via `GET /info`. The vulnerability requires network adjacency but no authentication. Fixed in version 1.6.58.
Affected products
- MervinPraison praisonaiagents < 1.6.58
Timeline
- 2026-06-13: disclosed
- 2026-08-25: advisory
- 2026-08-25: patched: Version 1.6.58 released with fix