CVE-2026-55528

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.

Researcher: Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI

Package: praisonaiagents on PyPI Affected version (empirically tested): 1.6.48 Component: praisonaiagents.server.AgentServer (the bundled HTTP / SSE server)

TL;DR

AgentServer.ServerConfig advertises an auth_token: Optional[str] = None field that operators set when they want to lock down the server. The GET /info endpoint even displays it back as "auth_token": "***" — strongly implying the value is wired into request authentication.

It isn't. AgentServer._create_app never reads auth_token, never adds an authentication middleware, and never decorates any route with a dependency that checks it. Every route — /info, /publish, /events, /health — accepts unauthenticated requests regardless of whether auth_token is configured.

The same package contains a sibling server, praisonaiagents.ui.a2a.A2A, written by the same developer, which implements the bearer-token pattern correctly via FastAPI's Depends(_verify_auth). This rules out the "auth is not yet implemented; operators are expected to add it" reading: the developer knew the pattern but did not apply it to AgentServer.

Root cause

   Expected behavior when setting ServerConfig(auth_token="…"):
     "Only requests with a matching Authorization header will be
      accepted on /publish, /events, /info."

   Actual behavior (server/server.py, dist 1.6.48):
     - line 31    auth_token: Optional[str] = None   # declared
     - line 39    "auth_token": "***" if self.auth_token else None  # displayed
     - lines 122-204:  no auth middleware, no Depends, no
                       request.headers["Authorization"] read,
                       no comparison to self.config.auth_token.

   Impact:
     The configuration knob is dead code from the route handlers'
     perspective.  All routes always run.  The operator has no signal
     that their auth_token was discarded — /info even confirms it
     was received by displaying "***".

Sibling proof — the same package gets it right elsewhere

praisonaiagents/ui/a2a/a2a.py:

# line 163
async def _verify_auth(authorization: Optional[str] = Header(None)):
    """Verify bearer token if auth_token is configured."""
    if self.auth_token is None:
        return
    ...
    if len(parts) != 2 or parts[0].lower() != "bearer" \
            or parts[1] != self.auth_token:
        raise HTTPException(status_code=401, ...)

# line 192
from fastapi import Depends
_a2a_deps = [Depends(_verify_auth)] if self.auth_token else []

That is the missing implementation. Porting it to AgentServer — either via Starlette BaseHTTPMiddleware or by switching to FastAPI and adding Depends(_verify_auth) to each route — closes the gap.

Affected routes (empirically tested)

| Route | Method | Accepts unauth requests? | Impact | |-------------|--------|--------------------------|------------------------------------------------------------------------| | /info | GET | Yes (200) | Leaks server config; confirms auth_token is set ("***"); reveals client count and CORS config. | | /publish | POST | Yes (200) | Anyone broadcasts arbitrary {type, data} to every subscribed agent. Event payload is whatever the attacker sends. | | /events | GET | Yes (200) | Anyone subscribes to the SSE stream and observes every event published by the server (and by any other anonymous attacker). | | /health | GET | Yes (200) | Leaks live SSE client count. |

Impact

The /publish and /events routes are the load-bearing ones. Together they let an unauthenticated network-adjacent attacker:

1. Inject control events…

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.

Researcher: Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI

Package: praisonaiagents on PyPI Affected version (empirically tested): 1.6.48 Component: praisonaiagents.server.AgentServer (the bundled HTTP / SSE server)

TL;DR

AgentServer.ServerConfig advertises an auth_token: Optional[str] = None field that operators set when they want to lock down the server. The GET /info endpoint even displays it back as "auth_token": "***" — strongly implying the value is wired into request authentication.

It isn't. AgentServer._create_app never reads auth_token, never adds an authentication middleware, and never decorates any route with a dependency that checks it. Every route — /info, /publish, /events, /health — accepts unauthenticated requests regardless of whether auth_token is configured.

The same package contains a sibling server, praisonaiagents.ui.a2a.A2A, written by the same developer, which implements the bearer-token pattern correctly via FastAPI's Depends(_verify_auth). This rules out the "auth is not yet implemented; operators are expected to add it" reading: the developer knew the pattern but did not apply it to AgentServer.

Root cause

   Expected behavior when setting ServerConfig(auth_token="…"):
     "Only requests with a matching Authorization header will be
      accepted on /publish, /events, /info."

   Actual behavior (server/server.py, dist 1.6.48):
     - line 31    auth_token: Optional[str] = None   # declared
     - line 39    "auth_token": "***" if self.auth_token else None  # displayed
     - lines 122-204:  no auth middleware, no Depends, no
                       request.headers["Authorization"] read,
                       no comparison to self.config.auth_token.

   Impact:
     The configuration knob is dead code from the route handlers'
     perspective.  All routes always run.  The operator has no signal
     that their auth_token was discarded — /info even confirms it
     was received by displaying "***".

Sibling proof — the same package gets it right elsewhere

praisonaiagents/ui/a2a/a2a.py:

# line 163
async def _verify_auth(authorization: Optional[str] = Header(None)):
    """Verify bearer token if auth_token is configured."""
    if self.auth_token is None:
        return
    ...
    if len(parts) != 2 or parts[0].lower() != "bearer" \
            or parts[1] != self.auth_token:
        raise HTTPException(status_code=401, ...)

# line 192
from fastapi import Depends
_a2a_deps = [Depends(_verify_auth)] if self.auth_token else []

That is the missing implementation. Porting it to AgentServer — either via Starlette BaseHTTPMiddleware or by switching to FastAPI and adding Depends(_verify_auth) to each route — closes the gap.

Affected routes (empirically tested)

| Route | Method | Accepts unauth requests? | Impact | |-------------|--------|--------------------------|------------------------------------------------------------------------| | /info | GET | Yes (200) | Leaks server config; confirms auth_token is set ("***"); reveals client count and CORS config. | | /publish | POST | Yes (200) | Anyone broadcasts arbitrary {type, data} to every subscribed agent. Event payload is whatever the attacker sends. | | /events | GET | Yes (200) | Anyone subscribes to the SSE stream and observes every event published by the server (and by any other anonymous attacker). | | /health | GET | Yes (200) | Leaks live SSE client count. |

Impact

The /publish and /events routes are the load-bearing ones. Together they let an unauthenticated network-adjacent attacker:

1. Inject control events…

Researcher: Kai Aizen — SnailSploit (@SnailSploit), Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI

Package: praisonaiagents on PyPI Affected version (empirically tested): 1.6.48 Component: praisonaiagents.server.AgentServer (the bundled HTTP / SSE server)

TL;DR

AgentServer.ServerConfig advertises an auth_token: Optional[str] = None field that operators set when they want to lock down the server. The GET /info endpoint even displays it back as "auth_token": "***" — strongly implying the value is wired into request authentication.

It isn't. AgentServer._create_app never reads auth_token, never adds an authentication middleware, and never decorates any route with a dependency that checks it. Every route — /info, /publish, /events, /health — accepts unauthenticated requests regardless of whether auth_token is configured.

The same package contains a sibling server, praisonaiagents.ui.a2a.A2A, written by the same developer, which implements the bearer-token pattern correctly via FastAPI's Depends(_verify_auth). This rules out the "auth is not yet implemented; operators are expected to add it" reading: the developer knew the pattern but did not apply it to AgentServer.

Root cause

   Expected behavior when setting ServerConfig(auth_token="…"):
     "Only requests with a matching Authorization header will be
      accepted on /publish, /events, /info."

   Actual behavior (server/server.py, dist 1.6.48):
     - line 31    auth_token: Optional[str] = None   # declared
     - line 39    "auth_token": "***" if self.auth_token else None  # displayed
     - lines 122-204:  no auth middleware, no Depends, no
                       request.headers["Authorization"] read,
                       no comparison to self.config.auth_token.

   Impact:
     The configuration knob is dead code from the route handlers'
     perspective.  All routes always run.  The operator has no signal
     that their auth_token was discarded — /info even confirms it
     was received by displaying "***".

Sibling proof — the same package gets it right elsewhere

praisonaiagents/ui/a2a/a2a.py:

# line 163
async def _verify_auth(authorization: Optional[str] = Header(None)):
    """Verify bearer token if auth_token is configured."""
    if self.auth_token is None:
        return
    ...
    if len(parts) != 2 or parts[0].lower() != "bearer" \
            or parts[1] != self.auth_token:
        raise HTTPException(status_code=401, ...)

# line 192
from fastapi import Depends
_a2a_deps = [Depends(_verify_auth)] if self.auth_token else []

That is the missing implementation. Porting it to AgentServer — either via Starlette BaseHTTPMiddleware or by switching to FastAPI and adding Depends(_verify_auth) to each route — closes the gap.

Affected routes (empirically tested)

| Route | Method | Accepts unauth requests? | Impact | |-------------|--------|--------------------------|------------------------------------------------------------------------| | /info | GET | Yes (200) | Leaks server config; confirms auth_token is set ("***"); reveals client count and CORS config. | | /publish | POST | Yes (200) | Anyone broadcasts arbitrary {type, data} to every subscribed agent. Event payload is whatever the attacker sends. | | /events | GET | Yes (200) | Anyone subscribes to the SSE stream and observes every event published by the server (and by any other anonymous attacker). | | /health | GET | Yes (200) | Leaks live SSE client count. |

Impact

The /publish and /events routes are the load-bearing ones. Together they let an unauthenticated network-adjacent attacker:

1. Inject control events…