CVE-2026-57146: PraisonAI authentication bypass in A2U event streaming

CVE-2026-57146 · Severity: high · CVSS 7.5 · Published 2026-10-23

PraisonAI is a multi-agent orchestration platform that uses an A2U (Agent-to-User) event streaming system to relay agent responses and tool calls. A previous security fix was incomplete: the A2U server started via the documented CLI command remains unauthenticated by default even when bound to network interfaces, allowing attackers to subscribe to sensitive agent events without credentials. Operators who deployed the supposedly-fixed version believing the vulnerability was resolved now expose confidential agent communications and decision-making data.

Technologies: MervinPraison PraisonAI, praisonai (PyPI). Vendors: MervinPraison, PyPI.

Quick answers

Is CVE-2026-57146 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57146 being exploited in the wild.
How severe is CVE-2026-57146?
High severity, with a CVSS score of 7.5, published 23 October 2026.
Which products and versions are affected?
MervinPraison PraisonAI 4.5.115 to before 4.6.61; praisonai (PyPI) ECOSYSTEM:introduced=4.5.115,fixed=4.6.61.
Is there a fix for CVE-2026-57146?
Yes. praisonai (PyPI): upgrade to 4.6.61 or later. Until then: Set the A2U_AUTH_TOKEN environment variable before starting the A2U server with praisonai serve a2u to enforce authentication. Restrict network binding to 127.0.0.1 instead of 0.0.0.0 to limit exposure to local connections only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57146 attacked?
It is attacked over the network.
Am I affected by CVE-2026-57146?
Check whether you run MervinPraison PraisonAI or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai (PyPI): upgrade to 4.6.61 or later
    pip install "praisonai>=4.6.61"

Set the A2U_AUTH_TOKEN environment variable before starting the A2U server with praisonai serve a2u to enforce authentication. Restrict network binding to 127.0.0.1 instead of 0.0.0.0 to limit exposure to local connections only.

Technical details

The vulnerability is an incomplete authentication fix: A2U routes are registered without mandatory authentication when the A2U_AUTH_TOKEN environment variable is absent, returning None from the auth check and treating authentication as disabled. An unauthenticated attacker with network access to the A2U server can call /a2u/subscribe and /a2u/events/{stream_name} endpoints to stream agent responses, tool calls, and progress events. The fix requires generating and enforcing authentication tokens by default in the CLI entrypoint, similar to the unified API server behavior.

Affected products

  • MervinPraison PraisonAI 4.5.115 to before 4.6.61

Identifiers

  • CVE-2026-57146
  • GHSA-jxcw-qp4h-6jfq
  • PYSEC-2026-3515

Timeline

  • 2026-06-17: disclosed: GitHub Security Advisory GHSA-jxcw-qp4h-6jfq published
  • 2026-06-17: patched: Version 4.6.61 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.