Summary
PraisonAI exposes A2U subscription and event-streaming routes without authentication when the documented CLI entrypoint starts the service without an authentication token. An unauthenticated remote user may subscribe to events or access information intended for authorized clients, creating elevated risk when the service is network-accessible.
PraisonAI exposes A2U subscription and event-streaming routes without authentication when the documented CLI entrypoint starts the service without an authentication token. An unauthenticated remote user may subscribe to events or access information intended for authorized clients, creating elevated risk when the service is network-accessible.
Affected context
The issue affects PraisonAI deployments within the affected version range that use the documented CLI entrypoint and expose the A2U event routes. The CLI wrapper does not configure an API key or install common authentication middleware, while the A2U route helper treats a missing A2U_AUTH_TOKEN as authentication being disabled. Risk is greater when the service is reachable by untrusted or unauthenticated networks.
The issue affects PraisonAI deployments within the affected version range that use the documented CLI entrypoint and expose the A2U event routes. The CLI wrapper does not configure an API key or install common authentication middleware, while the A2U route helper treats a missing A2U_AUTH_TOKEN as authentication being disabled. Risk is greater when the service is reachable by untrusted or unauthenticated networks.
Exploit preconditions
- Attack surface: A2U subscription and event-streaming HTTP routes
- Required access: Network connectivity to the PraisonAI service; no valid credentials may be required
- Trigger point: A request to an exposed A2U route started through the affected CLI path
- Why exploitation is possible: Authentication is conditional on A2U_AUTH_TOKEN being present, and the CLI path does not reliably configure that token or equivalent middleware
- Attack surface: A2U subscription and event-streaming HTTP routes
- Required access: Network connectivity to the PraisonAI service; no valid credentials may be required
- Trigger point: A request to an exposed A2U route started through the affected CLI path
- Why exploitation is possible: Authentication is conditional on A2U_AUTH_TOKEN being present, and the CLI path does not reliably configure that token or equivalent middleware
Why this happens
The underlying bug is an authentication-design failure in which a security control is enabled only when an optional environment variable is configured. When the variable is absent, the request authentication function returns no failure and the routes continue processing requests. This behavior maps primarily to CWE-306, Missing Authentication for Critical Function, and may also result in information exposure consistent with CWE-200.
The underlying bug is an authentication-design failure in which a security control is enabled only when an optional environment variable is configured. When the variable is absent, the request authentication function returns no failure and the routes continue processing requests. This behavior maps primarily to CWE-306, Missing Authentication for Critical Function, and may also result in information exposure consistent with CWE-200.
Potential impact
- Unauthenticated users may subscribe to A2U event streams
- Private workflow, agent, or operational information could be disclosed
- Unauthorized clients could consume resources through event subscriptions
- Downstream systems may trust or act on information obtained through an exposed service
- Unauthenticated users may subscribe to A2U event streams
- Private workflow, agent, or operational information could be disclosed
- Unauthorized clients could consume resources through event subscriptions
- Downstream systems may trust or act on information obtained through an exposed service
General mitigation guidance
Mitigation generally focuses on making authentication mandatory and
fail-closed for every exposed A2U route.
Common defensive patterns include:
- Require a strong, explicitly configured authentication mechanism before registering or serving A2U routes
- Avoid treating missing credentials or missing security configuration as an unauthenticated operating mode
- Apply the same authentication and authorization middleware to CLI-launched and programmatically launched services
- Restrict network exposure through gateways, private interfaces, and deny-by-default access policies
- Limit event data and service privileges according to the least-privilege principle
- Add startup checks that prevent deployment when required security settings are absent
Mitigation generally focuses on making authentication mandatory and
fail-closed for every exposed A2U route.
Common defensive patterns include:
- Require a strong, explicitly configured authentication mechanism before registering or serving A2U routes
- Avoid treating missing credentials or missing security configuration as an unauthenticated operating mode
- Apply the same authentication and authorization middleware to CLI-launched and programmatically launched services
- Restrict network exposure through gateways, private interfaces, and deny-by-default access policies
- Limit event data and service privileges according to the least-privilege principle
- Add startup checks that prevent deployment when required security settings are absent
How teams detect issues like this
Detection can include:
- Static analysis and configuration checks for route registration without authentication middleware
- Code review searches for optional-token logic that disables authentication when an environment variable is unset
- Tests that invoke the documented CLI entrypoint with missing credentials and verify that A2U routes reject requests
- Network and API inventory reviews to identify publicly reachable event-streaming endpoints
- Policy enforcement requiring authentication and authorization for all production event and subscription routes
Automated security review tools may help identify route handlers whose authentication depends on optional configuration.
Detection can include:
- Static analysis and configuration checks for route registration without authentication middleware
- Code review searches for optional-token logic that disables authentication when an environment variable is unset
- Tests that invoke the documented CLI entrypoint with missing credentials and verify that A2U routes reject requests
- Network and API inventory reviews to identify publicly reachable event-streaming endpoints
- Policy enforcement requiring authentication and authorization for all production event and subscription routes
Automated security review tools may help identify route handlers whose authentication depends on optional configuration.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
