CVE-2026-34952
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets.
Risk Assessment
An unauthenticated attacker can access all agents and their tools, potentially leading to unauthorized actions and data leakage.
Recommendation
Immediately upgrade PraisonAI to version 4.5.97 or later.
Original NVD description (English source)
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97.