External risk intelligence

PraisonAI Browser Bridge Session Hijacking Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-40289

The vulnerability affects a browser bridge service that binds to 0.0.0.0 by default, making it network-accessible. Because this service is intended for browser automation and typically exposed to interact with web environments, it is commonly deployed as an active service reachable by network clients, creating a likely scenario for unauthorized access.

Missing Authentication

Praisonai

before 4.5.139before 1.5.140

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability exists in PraisonAI's browser bridge, impacting how it handles connections. This could allow unauthorized actors to take control of automation sessions and access sensitive information if the bridge is exposed to the network. The main concern at this time is to confirm if this technology is in use and if it is exposed.

Unauthenticated remote session hijacking is possible.
Leadership should remember the potential for unauthorized control.
Confirm relevance and network exposure if PraisonAI is in use.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker on the network can target the PraisonAI browser bridge, which is accessible by default on all network interfaces. By sending a specific message to the vulnerable WebSocket endpoint without needing any credentials, an attacker can hijack an active browser automation session. This allows them to control the session remotely, view sensitive information displayed in the browser, and execute automated actions.

No authentication required for access.
WebSocket endpoint is the trigger point.
Risk of unauthorized session control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to gain unauthorized remote control over connected browser automation sessions. This could lead to the leakage of sensitive information displayed in the browser and the misuse of automated actions. The attack is possible when the PraisonAI browser bridge is accessible over the network.

Browser automation sessions.
Network-accessible browser bridge.
Unauthorized session control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI browser bridge's default configuration makes it a prime target for unauthenticated remote session hijacking, potentially leading to unauthorized control and data leakage. Infrastructure and platform teams are likely responsible for managing this service. The immediate priority is to locate all instances of the affected PraisonAI and praisonaiagents components, assess their network reachability and business criticality, and identify the accountable system owners to plan a risk-based remediation strategy.

Identify affected PraisonAI instances.
Verify network exposure and business criticality.
Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI and its browser bridge?

PraisonAI is a framework for multi-agent systems that coordinate autonomous AI tasks. Its browser bridge component, initialized via the 'praisonai browser start' command, acts as a gateway that allows these AI agents to interact with web environments. It enables the agents to navigate pages, extract data, and perform automated tasks by linking AI logic to a live browser session.

What does CWE-306 mean for CVE-2026-40289?

CWE-306 refers to a Missing Authentication for Critical Function weakness. In the context of CVE-2026-40289, this means the software does not verify the identity of anyone connecting to its WebSocket endpoint. Because the system lacks this fundamental security check, an unauthorized user can interact with the browser bridge as if they were the legitimate administrator, gaining full control over active automation sessions.

How can an attacker trigger this vulnerability?

An attacker triggers this by connecting to the /ws WebSocket endpoint of a network-reachable bridge. They send a 'start_session' message; because the server fails to authenticate connections and incorrectly handles requests without an 'Origin' header, it accepts the command. Simply visiting the endpoint from a browser, which sends a standard Origin header, would not trigger the bypass, as the flaw relies specifically on omitting that header.

Is my system at risk according to Halo Surface Signal?

Yes, if your instance is network-reachable. Halo Surface Signal identifies this as a 'Likely' risk because the bridge binds to 0.0.0.0 by default, meaning it listens on all network interfaces rather than just the local machine. If your deployment is accessible via the broader network, any attacker with network connectivity to your infrastructure can hijack your browser automation sessions.

What is the first step to address this CVE?

The most effective response is to update your PraisonAI or praisonaiagents installations to the patched versions (4.5.139 and 1.5.140, respectively). Before applying the update, perform an inventory of all systems running these components to determine which are exposed to your network. If immediate patching is not possible, ensure the service is restricted to 'localhost' access only to prevent remote network connections.

References

github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8x8f…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.