External risk intelligence

PraisonAI Gateway Unauthenticated Agent Discovery and Message Relay.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-34952

PraisonAI functions as a gateway service designed to handle WebSocket connections and expose agent topology. As an edge-oriented service intended for communication with external clients and agents, it is commonly deployed in network-accessible configurations where public or wide-area network reachability is a standard part of its operational role.

Missing Authentication

Praisonai

before 4.5.97

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects the PraisonAI Gateway, a system used for multi-agent teams, allowing unauthenticated access to agent information and message relay capabilities. Without proper authentication, external clients can interact with and potentially control the agents and their tools, posing a significant risk to system integrity and data.

Unauthenticated access to agent communication.
Critical flaw impacts system control and data.
Confirm relevance and exposure of PraisonAI.

Attack Path

How an attacker could exploit the issue

An attacker on the network can connect to the PraisonAI Gateway's WebSocket endpoint without needing any credentials. This allows them to discover available agents and send commands to them, potentially leading to unauthorized actions or information disclosure.

Network access is required.
Connect to the WebSocket and send agent messages.
Unauthorized agent interaction.

Live Threat

Current exploitation, exposure, and threat context

The PraisonAI Gateway server, when running an unpatched version, allows any network client to connect and interact with registered agents and their tools without authentication. This could expose agent topology information and enable unauthorized message delivery to agents and their associated toolsets.

Agent topology and communication channels.
Connecting to an unauthenticated network endpoint.
Unauthorized message delivery to agents.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI Gateway's lack of authentication for WebSocket connections and agent topology exposes its internal workings and allows for unverified communication with agents. This vulnerability requires immediate attention from teams managing the PraisonAI deployment, likely involving platform or infrastructure owners. The first practical step is to identify all instances of the affected PraisonAI Gateway, determine their network exposure and business criticality, and then coordinate remediation with the vendor or internal teams.

Platform or infrastructure team owns.
Confirm network exposure and criticality.
Plan coordinated vendor remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework designed for orchestrating multi-agent teams. It uses a gateway server to manage agent topology and facilitate communication between these agents and their tool sets, often acting as a bridge for complex automated workflows.

What does CVE-2026-34952 mean for security?

This vulnerability is classified as CWE-306, which means it lacks authentication for critical functions. Specifically, the PraisonAI gateway allows anyone on the network to connect to its WebSocket endpoint or request topology information without providing any valid credentials.

How does an attacker trigger this vulnerability?

An attacker triggers this by simply connecting to the gateway's WebSocket endpoint at /ws or accessing the /info path. This does not require special privileges or complex steps, but it does require network reachability to the server. Legitimate local inter-process communication that does not traverse the network is not the primary path for this remote access flaw.

Why is this a risk for my infrastructure?

According to Halo Surface Signal, PraisonAI is often deployed as an edge-oriented service, making it highly likely to be internet-facing. Because the gateway accepts commands without authentication, anyone who can reach the service over the network could potentially control your agents or access sensitive data handled by their tools.

What should I do if I use PraisonAI?

First, identify all active instances of the PraisonAI Gateway in your environment. Check your version numbers; if you are running anything earlier than 4.5.97, update immediately to the latest version to apply the required authentication patches. Coordinate with your infrastructure team to verify if your instances are accessible from the network and ensure the update is deployed.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cfh6…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.