CVE-2026-34952CRITICAL 9.1EPSS p36.5%

CVE-2026-34952CVE-2026-34952

praison / praisonai

Description

PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97.

Scoring

CVSS 3.19.1 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS0.44% probability of exploitation · percentile 36.5% · 2026-08-03T12:00:16Z
Published2026-04-03
Last modified2026-07-24

Underlying weaknesses· 1

CWE-306

References

  1. https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cfh6-vr3j-qc3g
  2. https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cfh6-vr3j-qc3g

1

TypeTargetConfidenceTier
WeaknessMissing Authentication for Critical Functioncwe-3060%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-40289
CVE
CVE-2026-34953
CVE
CVE-2026-34935
CVE
CVE-2026-34934
CVE
CVE-2026-34954
CVE
CVE-2026-44335
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.