GHSA-JXCW-QP4H-6JFQ

The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint:

praisonai serve a2u --host 0.0.0.0 --port 8002

The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled.

This is an incomplete-fix report for the published A2U issue, not a separate trust-model-only concern.

Technical Details

The Typer command for A2U accepts only --host and --port:

src/praisonai/praisonai/cli/commands/serve.py:570-585

It forwards only those values to the shared serve handler:

args = ["a2u", "--host", host, "--port", str(port)]

The serve handler for A2U likewise accepts only host and port, then creates the app:

src/praisonai/praisonai/cli/features/serve.py:802-817

_create_a2u_app() registers A2U routes directly:

src/praisonai/praisonai/cli/features/serve.py:827-853

No call to _install_api_key_middleware(app, ...) is made for the dedicated A2U server, unlike the unified server path.

Inside create_a2u_routes(), auth is opt-in:

src/praisonai/praisonai/endpoints/a2u_server.py:245-253

auth_token = os.environ.get("A2U_AUTH_TOKEN")
if not auth_token:
    # No token configured - auth disabled (development mode)
    return None

The route helper then registers the same sensitive endpoints from the public advisory:

src/praisonai/praisonai/endpoints/a2u_server.py:391-409

Why This Is Not Intended Behavior

The public advisory for GHSA-f292-66h9-fpmf describes unauthenticated /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health as the vulnerability and lists 4.5.115 as patched.

Current documentation also says PraisonAI API servers are now secure by default, bind to 127.0.0.1, and generate a bearer token if no token is provided. The dedicated A2U command does not implement that secure-by-default behavior. It remains unauthenticated unless a different environment variable, A2U_AUTH_TOKEN, was set before startup.

This report does not claim that explicit local-only development mode is always a vulnerability. The issue is the mismatch between the published fixed version / secure-by-default posture and the current A2U CLI behavior, including external binding via --host 0.0.0.0.

PoV

Run:

python3 poc/pov_poc.py \
  --repo /path/to/PraisonAI \
  --json

Observed current-head output:

{
  "no_token": {
    "info_status_no_auth": 200,
    "subscribe_status_no_auth": 200,
    "health_status_no_auth": 200,
    "subscribe_body": {
      "stream_name": "events",
      "stream_url": "http://testserver/a2u/events/sub-d8ee868a5491"
    }
  },
  "with_token": {
    "info_status_no_auth": 401,
    "subscribe_status_no_auth": 401,
    "info_with_token": 200,
    "subscribe_with_token": 200
  },
  "vulnerable_current_default": true
}

The PoV is local-only. It uses a small Starlette response/route shim so it can invoke the registered A2U handlers without starting a network listener or installing dependencies. The control shows that the route-level token check works when A2U_AUTH_TOKEN is configured; the vulnerable behavior is that the current documented CLI path does not require or generate that token.

PoC

The PoV section above contains the local reproduction command, input, and decisive output.

Severity

Suggested severity: High.

Affected Package/Versions

• Repository: MervinPraison/PraisonAI
• Ecosystem: pip
• Package: praisonai
• Component: A2U Agent-to-User event stream server
• Current checkout validated: 2f9677abb2ea68eab864ee8b6a828fd0141612e1
• Current checkout tag state: v4.6.57-4-g2f9677ab
• Public prior advisory: GHSA-f292-66h9-fpmf, fixed range claims praisonai <= 4.5.114

Suggested affected range:

pip:praisonai >= 4.5.115, <= 4.6.58

If maintainers prefer to update the public advisory rather than create a new advisory, the important correction is that the fixed version/range should not mark the current praisonai serve a2u behavior as fixed.

Advisory History

This is intentionally adjacent to GHSA-f292-66h9-fpmf. The report-grade point is that current versions after the claimed patched version still reproduce the same default unauthenticated A2U behavior through the maintained CLI entrypoint.

Visible PraisonAI advisories and prior submissions were checked. None cover A2U incomplete authentication after GHSA-f292-66h9-fpmf.

An attacker who can reach a current A2U server started without A2U_AUTH_TOKEN can subscribe to agent event streams without credentials. The prior public advisory already classifies the exposed data as agent responses, tool calls, thinking/progress events, and stream metadata.

If operators rely on the published fixed version or the secure-by-default serve documentation, they may expose A2U on a network interface believing the unauthenticated stream issue is fixed.

A critical operation is accessible without requiring any authentication. Typical impact: any user can invoke the privileged function.

GHSA-JXCW-QP4H-6JFQ has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.6.61); upgrading removes the vulnerable code path.

Kodem intelligence

Recommended:

1. Make praisonai serve a2u secure by default in the same way as the documented API servers: generate a bearer token when none is configured, print it to stderr, and enforce it on all non-public A2U endpoints.
2. Add --api-key / --auth-token support to the dedicated A2U command and pass the configured token into create_a2u_routes() or shared middleware.
3. Fail closed for external binds such as --host 0.0.0.0 unless authentication is enabled.
4. Require auth on /a2u/health or remove subscription and stream counts from unauthenticated health responses.
5. Add regression tests for praisonai serve a2u proving unauthenticated /a2u/subscribe returns 401 on current/fixed versions by default.

1. What is GHSA-JXCW-QP4H-6JFQ? GHSA-JXCW-QP4H-6JFQ is a high-severity missing authentication for critical function vulnerability in praisonai (pip), affecting versions >= 4.5.115, < 4.6.61. It is fixed in 4.6.61. A critical operation is accessible without requiring any authentication.
2. How severe is GHSA-JXCW-QP4H-6JFQ? GHSA-JXCW-QP4H-6JFQ has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of praisonai are affected by GHSA-JXCW-QP4H-6JFQ? praisonai (pip) versions >= 4.5.115, < 4.6.61 is affected.
4. Is there a fix for GHSA-JXCW-QP4H-6JFQ? Yes. GHSA-JXCW-QP4H-6JFQ is fixed in 4.6.61. Upgrade to this version or later.
5. Is GHSA-JXCW-QP4H-6JFQ exploitable, and should I be worried? Whether GHSA-JXCW-QP4H-6JFQ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-JXCW-QP4H-6JFQ is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-JXCW-QP4H-6JFQ? Upgrade praisonai to 4.6.61 or later.