Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2026-34952

PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97.

VectorNETWORK

PublishedApr 03, 2026, 23:17

Published Bysecurity-advisories@github.com

Base Score

Score9.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

praisonai(PyPI)04.5.97N/A

References

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cfh6-vr3j-qc3g

Weakness Type

CWE-306

CVSS Metrics

Base Score

9.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK