Is CVE-2026-57128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57128 being exploited in the wild.

How severe is CVE-2026-57128?

Medium severity, with a CVSS score of 4.3, published 14 September 2026.

Which products and versions are affected?

praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.59.

Is there a fix for CVE-2026-57128?

Yes. praisonaiagents (PyPI): upgrade to 1.6.59 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57128 attacked?

It is attacked over the network.

Am I affected by CVE-2026-57128?

Check whether you run praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57128: PraisonAI authentication bypass in SSE server endpoints

CVE-2026-57128 · Severity: medium · CVSS 4.3 · Published 2026-09-14

PraisonAI is a multi-agent AI system that uses Server-Sent Events (SSE) for real-time communication between the server and connected clients. The vulnerability allows unauthenticated network clients to broadcast arbitrary events to all connected users, disrupt communications, and retrieve sensitive server configuration and statistics without proper authorization. This could allow attackers to manipulate client interactions, obtain operational information, and potentially inject malicious content into client streams.

Technologies: praisonaiagents (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-57128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57128 being exploited in the wild.
How severe is CVE-2026-57128?: Medium severity, with a CVSS score of 4.3, published 14 September 2026.
Which products and versions are affected?: praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.59.
Is there a fix for CVE-2026-57128?: Yes. praisonaiagents (PyPI): upgrade to 1.6.59 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57128 attacked?: It is attacked over the network.
Am I affected by CVE-2026-57128?: Check whether you run praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonaiagents (PyPI): upgrade to 1.6.59 or later
```
pip install "praisonaiagents>=1.6.59"
```

Technical details

The SSE server in PraisonAI versions prior to 1.6.58 fails to validate the ServerConfig.auth_token before processing requests to the /publish, /events, and /info endpoints. An attacker with network access to the server can send unauthenticated HTTP requests to these endpoints to broadcast events to all connected clients and retrieve server metadata including configuration and active client counts. No authentication, special privileges, or user interaction is required. The vulnerability was patched in version 1.6.58 by implementing proper authentication token validation on the affected endpoints.

Affected products

PraisonAI PraisonAI prior to 1.6.58

Identifiers

CVE-2026-57128
GHSA-35w5-pcw4-jx94
PYSEC-2026-3528

Timeline

2026-09-14: disclosed: CVE-2026-57128 published
2026-06-13: patched: Fixed in version 1.6.58

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.