CVE-2026-39889 PraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server

High 7.5 Published 8 Apr 2026 Updated 10 Apr 2026

Unauthenticated access to A2U event streams allows attackers to view all agent activity in PraisonAI.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-39889?

CVE-2026-39889 is a high-severity vulnerability in MervinPraison PraisonAI, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication. The create_a2u_routes() function registers the following endpoints with NO authentication checks: /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health. This vulnerability is fixed in 4.5.115.

Weakness: CWE-200

Which versions are affected by CVE-2026-39889?

3 open source packages ship an affected version, including praisonai. It affects 1 product.

Package	Affected	Fixed in
`praisonai` PyPI	All versions	`4.5.115`
`praisonai` PyPI	All versions	`4.5.115`
`praisonai` PyPI	All versions	`4.5.115`

Products include Praison Praisonai.

How do I fix CVE-2026-39889?

Upgrade praisonai to 4.5.115 or later.

Is CVE-2026-39889 being exploited?

There is no known exploitation of CVE-2026-39889 in the wild and no public exploit code.

Sources

Also known as GHSA-f292-66h9-fpmf, PYSEC-2026-2911.