CVE-2026-34952: Praison Praisonai Auth Bypass Vulnerability

CVE-2026-34952 Overview

CVE-2026-34952 is a critical Missing Authentication for Critical Function (CWE-306) vulnerability in PraisonAI, a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets.

Critical Impact
Unauthenticated remote attackers can enumerate registered agents, access sensitive agent topology information, and send arbitrary messages to agents and their tool sets, potentially leading to complete compromise of the multi-agent system.

Affected Products

PraisonAI versions prior to 4.5.97
praison praisonai (all affected versions)

Discovery Timeline

2026-04-03 - CVE-2026-34952 published to NVD
2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-34952

Vulnerability Analysis

This vulnerability represents a fundamental security architecture flaw in the PraisonAI Gateway server. The lack of authentication on critical WebSocket endpoints (/ws) and the agent topology information endpoint (/info) allows any network-accessible client to interact with the multi-agent system without authorization. This missing authentication mechanism enables attackers to fully enumerate all registered agents within the system and understand the system's architecture before launching more targeted attacks.

The vulnerability is particularly concerning in multi-agent AI systems where agents may have access to sensitive data, execute privileged operations, or control automated workflows. An attacker exploiting this flaw gains the ability to send arbitrary messages to agents and their associated tool sets, which could result in unauthorized actions being performed by the AI agents.

Root Cause

The root cause of CVE-2026-34952 is the complete absence of authentication controls on the PraisonAI Gateway server's WebSocket and HTTP endpoints. The /ws WebSocket endpoint and /info HTTP endpoint were designed to accept connections without verifying the identity or authorization of the connecting client. This design flaw violates the principle of least privilege and secure-by-default architecture patterns, leaving critical agent communication channels exposed to any network client that can reach the Gateway server.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker with network access to the PraisonAI Gateway server can exploit this vulnerability by:

Connecting to the /info endpoint to enumerate all registered agents and understand the system topology
Establishing a WebSocket connection to the /ws endpoint without credentials
Sending arbitrary messages to any registered agent or their associated tool sets
Potentially manipulating agent behavior, extracting sensitive information processed by agents, or disrupting the multi-agent system's operations

The vulnerability allows for both reconnaissance through agent enumeration and active exploitation through arbitrary message injection. No specialized tools or techniques are required beyond standard HTTP and WebSocket clients.

Detection Methods for CVE-2026-34952

Indicators of Compromise

Unexpected or unauthorized WebSocket connections to the /ws endpoint from external IP addresses
Anomalous requests to the /info endpoint, especially from untrusted network sources
Unusual agent behavior or unexpected commands being processed by the multi-agent system
Network traffic patterns indicating enumeration attempts against the Gateway server

Detection Strategies

Monitor network traffic for connections to PraisonAI Gateway endpoints from unauthorized sources
Implement network-level logging for all connections to the /ws and /info endpoints
Deploy intrusion detection rules to alert on WebSocket connection attempts to unpatched PraisonAI instances
Review agent execution logs for commands or messages that do not originate from legitimate sources

Monitoring Recommendations

Enable comprehensive logging on the PraisonAI Gateway server to track all incoming connections
Implement network segmentation to restrict access to the Gateway server to only authorized hosts
Set up alerts for any connections from IP addresses outside the expected range
Regularly audit agent activity logs for signs of unauthorized interaction or command injection

How to Mitigate CVE-2026-34952

Immediate Actions Required

Upgrade PraisonAI to version 4.5.97 or later immediately
Restrict network access to the PraisonAI Gateway server using firewall rules until the patch is applied
Audit logs for any signs of unauthorized access or agent manipulation
Implement network segmentation to limit exposure of the Gateway server to trusted clients only

Patch Information

The vulnerability has been patched in PraisonAI version 4.5.97. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

Place the PraisonAI Gateway server behind a reverse proxy that enforces authentication for all endpoints
Implement firewall rules to restrict access to the /ws and /info endpoints to trusted IP addresses only
Deploy network access controls to ensure only authorized clients can reach the Gateway server
Consider using a VPN or private network segment for all PraisonAI Gateway communications until the patch is applied

bash

# Example firewall configuration to restrict access to PraisonAI Gateway
# Restrict access to the Gateway port (adjust port number as needed)
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP