Authentication Vulnerability in PraisonAI Multi-Agent System Gateway
CVE-2026-34952

9.1CRITICAL

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
3 April 2026

What is CVE-2026-34952?

The PraisonAI Gateway server, prior to version 4.5.97, suffers from a serious authentication issue. It allows any network client to establish WebSocket connections without proper authentication at the /ws endpoint. This flaw enables unauthorized users to access and enumerate details about registered agents and interact with their tool sets through arbitrary messages. The vulnerability poses significant risks to the security integrity of the system, making it essential for users to upgrade to version 4.5.97 or later to mitigate these threats.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

PraisonAI < 4.5.97

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.