Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication. The create_a2u_routes() function registers the following endpoints with NO authentication checks: /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health. This vulnerability is fixed in 4.5.115.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39889 PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication.… https://www.cve.org/CVERecord?id=CVE-2026-39889
Post summary
CVE-2026-39889 reveals that PraisonAI versions prior to 4.5.115 expose all agent activity via the A2U event stream server without authentication, indicating an unauthenticated data exposure.
🚨*CVE* CVE-2026-39889 PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication.… https://www.cve.org/CVERecord?id=CVE-2026-39889 ----- Traducción: CVE-2026-39889 Pra… http://infoflow.cloud`
Post summary
CVE‑2026‑39889 is disclosed as a pre‑4.5.115 PraisonAI vulnerability where the A2U event stream server lacks authentication, potentially leaking all agent activity.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | praison | praisonai | - | - | - |