MervinPraison PraisonAI missing authentication in A2U serve command

Executive brief

PraisonAI is a framework for managing AI agents. A vulnerability in its Agent-to-User (A2U) communication component allows unauthorized users to access sensitive event streams, including agent responses and tool calls. This occurs because the system fails to enforce authentication by default when started via certain command-line tools, potentially exposing private AI interactions to anyone on the network.

Technical details

An incomplete fix for a previous vulnerability (GHSA-f292-66h9-fpmf) allows the 'praisonai serve a2u' CLI command to bypass authentication requirements. The root cause is that the A2U-specific server entry point does not implement the 'secure-by-default' middleware used by other components, and the underlying route helper only enforces authentication if the 'A2U_AUTH_TOKEN' environment variable is manually set. A remote attacker can reach sensitive endpoints such as /a2u/subscribe and /a2u/events to intercept agent responses, tool calls, and metadata. The issue is resolved in version 4.6.61.

Affected products

• MervinPraison praisonai >= 4.5.115, < 4.6.61

Timeline

• 2026-06-17: disclosed: Initial report by rexpository
• 2026-06-18: advisory: GitHub Advisory GHSA-jxcw-qp4h-6jfq published
• 2026-06-18: patched: Fixed in version 4.6.61

References

• https://api.github.com/users/rexpository
• https://github.com/rexpository
• https://api.github.com/users/rexpository/gists%7B/gist_id%7D
• https://api.github.com/users/rexpository/repos
• https://avatars.githubusercontent.com/u/30176934?v=4
• https://api.github.com/users/rexpository/events%7B/privacy%7D