PYSEC-2026-2911 PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server

The A2U Agent-to-User event stream server in PraisonAI exposes all agent activity without authentication. This is a separate component from the gateway server fixed in CVE-2026-34952. The createa2uroutes function registers the following endpoints with NO authentication checks: - GET /a2u/info —...

Missing Source Correlation of Multiple Independent Data

Overview Affected versions of this package are vulnerable to Missing Source Correlation of Multiple Independent Data in the PUT /api/v1/subscriber/imsi API endpoint. An attacker can alter another user's policy settings and falsify audit logs by providing mismatched IMSI values in the request path...