Description

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast arbitrary events to connected clients and obtain server configuration and client-count information. This issue is fixed in praisonaiagents 1.6.58.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T15:17:06.177Z",
  "pubdate": "2026-09-14T15:17:06.177Z",
  "executiveSummary": "The PraisonAI multi-agent system, specifically within the praisonaiagents library, contains an authentication bypass vulnerability in its Server-Sent Events (SSE) implementation.\nPrior to version 1.6.58, the SSE server located at src/praisonai-agents/praisonaiagents/server/server.py fails to validate the ServerConfig.auth_token for critical API endpoints, including /publish, /events, and /info.\nThis vulnerability allows unauthorized network-adjacent attackers to interact with the SSE server without providing valid credentials.\nThe potential impact includes the unauthorized broadcast of arbitrary events to connected clients, leading to client-side misinformation or process disruption, as well as the exfiltration of sensitive server configuration data and real-time client-count metrics.\nThis flaw represents a significant security risk by exposing internal system telemetry and allowing unauthorized message injection, which could be leveraged to manipulate multi-agent workflows or disrupt service operations.\nThe attack requires network connectivity to the server but does not require prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides within the SSE server logic defined in src/praisonai-agents/praisonaiagents/server/server.py. The application maintains an authentication mechanism via ServerConfig.auth_token; however, this control is inconsistently applied across the server's HTTP routing layer.\nSpecifically, the handlers for the /publish, /events, and /info endpoints fail to invoke the required authentication middleware or perform an internal check against the configured token. As a result, the SSE server processes requests to these endpoints with an implied trust level, regardless of the presence or validity of an authentication header.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the accessible SSE server port. By crafting HTTP requests targeting the /info endpoint, the attacker can retrieve internal server configuration parameters and current client connection counts without authorization. Subsequently, by interacting with the /publish endpoint, the attacker can inject arbitrary event data into the SSE stream. Because SSE is a unidirectional protocol designed for server-to-client communication, the ability to 'publish' allows the attacker to broadcast malicious messages to all currently connected clients. These messages may trigger unintended behaviors in the agentic workflow or mislead connected clients dependent on the server's event stream.\nFurthermore, the /events endpoint is accessible to unauthorized actors, enabling the unsolicited monitoring of the event stream, which may expose sensitive operational data transmitted between agents.\nThe vulnerable component is the server request handling logic in the praisonaiagents package. All versions prior to 1.6.58 are confirmed as affected. The root cause is a deficiency in the request pipeline where security enforcement is bypassed at the application layer for specific routes. The exploitation is trivial, requiring only standard HTTP request construction to interact with the aforementioned endpoints. The impact is significant as it compromises the integrity of the agent communication channel and facilitates unauthorized information disclosure regarding the deployment environment."
}