GHSA-jxcw-qp4h-6jfq: PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
SummaryThe published A2U advisory `GHSA-f292-66h9-fpmf` says unauthenticated A2U event streaming was fixed in `praisonai` `4.5.115`. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint:The current CLI wrapper does not expose `--api-key`, does not install the common API-key middleware, and does not generate a token for A2U. It calls `create_a2u_routes(app)` directly. That helper only enforces auth if `A2U_AUTH_TOKEN` is already present; if the variable is missing, `_authenticate_request()` returns `None` and treats auth as disabled.This is an incomplete-fix report for the published A2U issue, not a separate trust-model-only concern.Technical DetailsThe Typer command for A2U accepts only `--host` and `--port`:It forwards only those values to the shared serve handler:The serve handler for A2U likewise accepts only `host` and `port`, then creates the app:`_create_a2u_app()` registers A2U routes directly:No call to `_install_api_key_middleware(app, ...)` is made for the dedicated A2U server, unlike the unified server path.Inside `create_a2u_routes()`, auth is opt-in:The route helper then registers the same sensitive endpoints from the public advisory:Why This Is Not Intended BehaviorThe public advisory for `GHSA-f292-66h9-fpmf` describes unauthenticated `/a2u/info`, `/a2u/subscribe`, `/a2u/events/{stream_name}`, `/a2u/events/sub/{id}`, and `/a2u/health` as the vulnerability and lists `4.5.115` as patched.Current documentation also says PraisonAI API servers are now secure by default, bind to `127.0.0.1`, and generate a bearer token if no token is provided. The dedicated A2U command does not implement that secure-by-default behavior. It remains unauthenticated unless a different environment variable, `A2U_AUTH_TOKEN`, was set before startup.This report does not claim that explicit local-only development mode is always a vulnerability. The issue is the mismatch between the published fixed version / secure-by-default posture and the current A2U CLI behavior, including external binding via `--host 0.0.0.0`.PoVRun:Observed current-head output:The PoV is local-only. It uses a small Starlette response/route shim so it can invoke the registered A2U handlers without starting a network listener or installing dependencies. The control shows that the route-level token check works when `A2U_AUTH_TOKEN` is configured; the vulnerable behavior is that the current documented CLI path does not require or generate that token.PoCThe PoV section above contains the local reproduction command, input, and decisive output.ImpactAn attacker who can reach a current A2U server started without `A2U_AUTH_TOKEN` can subscribe to agent event streams without credentials. The prior public advisory already classifies the exposed data as agent responses, tool calls, thinking/progress events, and stream metadata.If operators rely on the published fixed version or the secure-by-default serve documentation, they may expose A2U on a network interface believing the unauthenticated stream issue is fixed.SeveritySuggested severity: High.Suggested FixRecommended:Make `praisonai serve a2u` secure by default in the same way as the documented API servers: generate a bearer token when none is configured, print it to stderr, and enforce it on all non-public A2U endpoints.Add `--api-key` / `--auth-token` support to the dedicated A2U command and pass the configured token into `create_a2u_routes()` or shared middleware.Fail closed for external binds such as `--host 0.0.0.0` unless authentication is enabled.Require auth on `/a2u/health` or remove subscription and stream counts from unauthenticated health responses.Add regression tests for `praisonai serve a2u` proving unauthenticated `/a2u/subscribe` returns `401` on current/fixed versions by default.Affected Package/VersionsRepository: `MervinPraison/PraisonAI`Ecosystem: `pip`Package: `praisonai`Component: A2U Agent-to-User event stream serverCurrent checkout validated: `2f9677abb2ea68eab864ee8b6a828fd0141612e1`Current checkout tag state: `v4.6.57-4-g2f9677ab`Public prior advisory: `GHSA-f292-66h9-fpmf`, fixed range claims `praisonai <= 4.5.114`Suggested affected range:If maintainers prefer to update the public advisory rather than create a new advisory, the important correction is that the fixed version/range should not mark the current `praisonai serve a2u` behavior as fixed.Advisory HistoryThis is intentionally adjacent to `GHSA-f292-66h9-fpmf`. The report-grade point is that current versions after the claimed patched version still reproduce the same default unauthenticated A2U behavior through the maintained CLI entrypoint.Visible PraisonAI advisories and prior submissions were checked. None cover A2U incomplete authentication after `GHSA-f292-66h9-fpmf`.
CVSS v3.1: 7.5