CVE-2026-39889

🗓️ 08 Apr 2026 20:44:24Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 18 Views🌐 WEB

PraisonAI A2U SSE stream exposes all agent activity without auth; fixed in 4.5.115.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-39889	9 Apr 202601:27	–	circl
CNNVD	PraisonAI 信息泄露漏洞	8 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-39889 PraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server	8 Apr 202620:44	–	cvelist
EUVD	EUVD-2026-20636	8 Apr 202619:21	–	euvd
Github Security Blog	PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server	8 Apr 202619:21	–	github
NVD	CVE-2026-39889	8 Apr 202621:17	–	nvd
OSV	GHSA-F292-66H9-FPMF PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server	8 Apr 202619:21	–	osv
Positive Technologies	PT-2026-31456	8 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-39889	11 Apr 202601:21	–	redhatcve
Snyk	Missing Authentication for Critical Function	8 Apr 202619:21	–	snyk

NVD

Vulners

Node

praison praisonaiRange≤4.5.114

[
  {
    "vendor": "MervinPraison",
    "product": "PraisonAI",
    "versions": [
      {
        "version": "< 4.5.115",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f292-66h9-fpmf

Parameter	Position	Path	Description	CWE
stream_name	path	/a2u/events/{stream_name}	Unauthenticated access to A2U event stream by name	CWE-200
id	path	/a2u/events/sub/{id}	Unauthenticated access to A2U sub events by id	CWE-200

17 Jun 2026 10:42Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00425

SSVC

CWE-200