CVE-2026-34952CWE-306

PraisonAI: Missing Authentication in WebSocket Gateway

Critical · published April 3, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-04-03T22:53Z
EPSS history
Timeline
  • 03 APR 22:53Z
    PraisonAI: Missing Authentication in WebSocket Gateway
    cvelistv5