PraisonAI’s Agent‑to‑User event stream server lacks authentication checks, allowing any user to subscribe to server‑sent events and view complete agent activity logs. This exposes private operational details, potential credentials, and internal communications. The vulnerability is a classic information‑disclosure flaw that can be exploited to learn sensitive system data without needing privileged access.

The vulnerability applies to PraisonAI builds prior to version 4.5.115. Endpoints such as /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health are unprotected and may be accessed by anyone able to reach the A2U server. No other vendors or products are currently reported impacted.

The CVSS base score of 7.5 indicates moderate‑to‑high severity. Although the EPSS score is less than 1%, the lack of authentication means an attacker only needs network access to the server, and no additional conditions or privileges are required. The vulnerability is not listed in the CISA KEV catalog, suggesting no mass exploitation yet, but the exposure of full agent activity poses significant risk to confidentiality and operational integrity. Because the attack vector is remote HTTP, any exposed network surface could be used by threat actors.