PT-2026-81319 · Pypi · Praisonaiagents
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
praisonaiagents versions prior to 1.6.58
Description
In the
AgentServer component, the ServerConfig.auth token variable is exposed but not validated by the AgentServer. create app() function across any routes. This allows a remote caller to perform actions without a valid bearer token or X-Auth-Token, even when authentication is configured. An unauthenticated attacker can eavesdrop on the event bus, inject control events into agent processes, and leak server configurations.API Endpoints:
/info(GET): Leaks server configuration and confirms if anauth tokenis set./publish(POST): Allows broadcasting arbitrary event payloads to all subscribed agents./events(GET): Allows subscription to the Server-Sent Events (SSE) stream to observe all published events./health(GET): Leaks the current count of live SSE clients.
Vulnerable Parameters or Variables:
auth token
Recommendations
Update praisonaiagents to version 1.6.58.
As a temporary workaround, restrict network access to the
AgentServer to trusted sources only to minimize the risk of unauthorized access to the affected endpoints.Exploit
Fix
Missing Authentication
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonaiagents