CVE-2026-57146: Praisonai PraisonAI A2U Incomplete Authentication Fix Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jxcw-qp4h-6jfq",
  "modified" : "2026-07-20T21:31:16Z",
  "published" : "2026-06-18T14:27:00Z",
  "aliases" : [ "CVE-2026-57146" ],
  "summary" : "PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default",
  "details" : "## Summary\n\nThe published A2U advisory `GHSA-f292-66h9-fpmf` says unauthenticated A2U event streaming was fixed in `praisonai` `4.5.115`. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint:\n\n```text\npraisonai serve a2u --host 0.0.0.0 --port 8002\n```\n\nThe current CLI wrapper does not expose `--api-key`, does not install the common API-key middleware, and does not generate a token for A2U. It calls `create_a2u_routes(app)` directly. That helper only enforces auth if `A2U_AUTH_TOKEN` is already present; if the variable is missing, `_authenticate_request()` returns `None` and treats auth as disabled.\n\nThis is an incomplete-fix report for the published A2U issue, not a separate trust-model-only concern.\n\n## Technical Details\n\nThe Typer command for A2U accepts only `--host` and `--port`:\n\n```text\nsrc/praisonai/praisonai/cli/commands/serve.py:570-585\n```\n\nIt forwards only those values to the shared serve handler:\n\n```python\nargs = [\"a2u\", \"--host\", host, \"--port\", str(port)]\n```\n\nThe serve handler for A2U likewise accepts only `host` and `port`, then creates the app:\n\n```text\nsrc/praisonai/praisonai/cli/features/serve.py:802-817\n```\n\n`_create_a2u_app()` registers A2U routes directly:\n\n```text\nsrc/praisonai/praisonai/cli/features/serve.py:827-853\n```\n\nNo call to `_install_api_key_middleware(app, ...)` is made for the dedicated A2U server, unlike the unified server path.\n\nInside `create_a2u_routes()`, auth is opt-in:\n\n```text\nsrc/praisonai/praisonai/endpoints/a2u_server.py:245-253\n```\n\n```python\nauth_token = os.environ.get(\"A2U_AUTH_TOKEN\")\nif not auth_token:\n    # No token configured - auth disabled (development mode)\n    return None\n```\n\nThe route helper then registers the same sensitive endpoints from the public advisory:\n\n```text\nsrc/praisonai/praisonai/endpoints/a2u_server.py:391-409\n```\n\n### Why This Is Not Intended Behavior\n\nThe public advisory for `GHSA-f292-66h9-fpmf` describes unauthenticated `/a2u/info`, `/a2u/subscribe`, `/a2u/events/{stream_name}`, `/a2u/events/sub/{id}`, and `/a2u/health` as the vulnerability and lists `4.5.115` as patched.\n\nCurrent documentation also says PraisonAI API servers are now secure by default, bind to `127.0.0.1`, and generate a bearer token if no token is provided. The dedicated A2U command does not implement that secure-by-default behavior. It remains unauthenticated unless a different environment variable, `A2U_AUTH_TOKEN`, was set before startup.\n\nThis report does not claim that explicit local-only development mode is always a vulnerability. The issue is the mismatch between the published fixed version / secure-by-default posture and the current A2U CLI behavior, including external binding via `--host 0.0.0.0`.\n\n## PoV\n\nRun:\n\n```bash\npython3 poc/pov_poc.py \\\n  --repo /path/to/PraisonAI \\\n  --json\n```\n\nObserved current-head output:\n\n```json\n{\n  \"no_token\": {\n    \"info_status_no_auth\": 200,\n    \"subscribe_status_no_auth\": 200,\n    \"health_status_no_auth\": 200,\n    \"subscribe_body\": {\n      \"stream_name\": \"events\",\n      \"stream_url\": \"http://testserver/a2u/events/sub-d8ee868a5491\"\n    }\n  },\n  \"with_token\": {\n    \"info_status_no_auth\": 401,\n    \"subscribe_status_no_auth\": 401,\n    \"info_with_token\": 200,\n    \"subscribe_with_token\": 200\n  },\n  \"vulnerable_current_default\": true\n}\n```\n\nThe PoV is local-only. It uses a small Starlette response/route shim so it can invoke the registered A2U handlers without starting a network listener or installing dependencies. The control shows that the route-level token check works when `A2U_AUTH_TOKEN` is configured; the vulnerable behavior is that the current documented CLI path does not require or generate that token.\n\n## PoC\n\nThe PoV section above contains the local reproduction command, input, and decisive output.\n\n## Impact\n\nAn attacker who can reach a current A2U server started without `A2U_AUTH_TOKEN` can subscribe to agent event streams without credentials. The prior public advisory already classifies the exposed data as agent responses, tool calls, thinking/progress events, and stream metadata.\n\nIf operators rely on the published fixed version or the secure-by-default serve documentation, they may expose A2U on a network interface believing the unauthenticated stream issue is fixed.\n\n### Severity\n\nSuggested severity: High.\n\n## Suggested Fix\n\nRecommended:\n\n1. Make `praisonai serve a2u` secure by default in the same way as the documented API servers: generate a bearer token when none is configured, print it to stderr, and enforce it on all non-public A2U endpoints.\n2. Add `--api-key` / `--auth-token` support to the dedicated A2U command and pass the configured token into `create_a2u_routes()` or shared middleware.\n3. Fail closed for external binds such as `--host 0.0.0.0` unless authentication is enabled.\n4. Require auth on `/a2u/health` or remove subscription and stream counts from unauthenticated health responses.\n5. Add regression tests for `praisonai serve a2u` proving unauthenticated `/a2u/subscribe` returns `401` on current/fixed versions by default.\n\n## Affected Package/Versions\n\n- Repository: `MervinPraison/PraisonAI`\n- Ecosystem: `pip`\n- Package: `praisonai`\n- Component: A2U Agent-to-User event stream server\n- Current checkout validated: `2f9677abb2ea68eab864ee8b6a828fd0141612e1`\n- Current checkout tag state: `v4.6.57-4-g2f9677ab`\n- Public prior advisory: `GHSA-f292-66h9-fpmf`, fixed range claims `praisonai <= 4.5.114`\n\nSuggested affected range:\n\n```text\npip:praisonai >= 4.5.115, <= 4.6.58\n```\n\nIf maintainers prefer to update the public advisory rather than create a new advisory, the important correction is that the fixed version/range should not mark the current `praisonai serve a2u` behavior as fixed.\n\n## Advisory History\n\nThis is intentionally adjacent to `GHSA-f292-66h9-fpmf`. The report-grade point is that current versions after the claimed patched version still reproduce the same default unauthenticated A2U behavior through the maintained CLI entrypoint.\n\nVisible PraisonAI advisories and prior submissions were checked. None cover A2U incomplete authentication after `GHSA-f292-66h9-fpmf`.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "praisonai"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.5.115"
      }, {
        "fixed" : "4.6.61"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jxcw-qp4h-6jfq"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-306" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-18T14:27:00Z",
    "nvd_published_at" : null
  }
}