CyberRota Analysis
AI-GeneratedThe SSE server in PraisonAI versions prior to 1.6.58 lacks proper authentication checks for handling specific requests, allowing an unauthenticated network client to broadcast arbitrary events and access sensitive server configuration and client-count data. This vulnerability poses a risk of unauthorized information disclosure and potential manipulation of connected clients. Organizations using affected versions of PraisonAI should prioritize updating to version 1.6.58 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast arbitrary events to connected clients and obtain server configuration and client-count information. This issue is fixed in praisonaiagents 1.6.58.