CVE-2026-57128Medium· 4.3▾ TwilightPoC available

PraisonAI is a multi-agent teams system

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score36/ 100 · Low

impact 23.7 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Sep 14, 2026

Updated

Sep 16, 2026

CVSS

4.3

Vendor

MervinPraison

Product

PraisonAI

CWE

CWE-306

Depth score

36 · Low

EPSS

0.16% · p6

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

decided 2026-09-14

Exploitation: poc
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 15.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 2 days

Sep 14, 2026Published
Disclosed via NVD
Sep 14, 2026Public exploit observed
Exploit / PoC code exists
Sep 15, 2026EPSS first tracked
0.2%
Sep 16, 2026Record revised
Last analysed / modified upstream

MervinPraison CWE-306 #nvd #cve.org #osv #pip #exploit-available

Affected

PraisonAI < 1.6.58

Patched in

praisonaiagents 1.6.59

Full technical detail▾

Overview

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.auth_token before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast arbitrary events to connected clients and obtain server configuration and client-count information. This issue is fixed in praisonaiagents 1.6.58.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-57128)

Affected packages:

praisonaiagents < 1.6.59

Patched in:

praisonaiagents 1.6.59

Source: https://osv.dev/vulnerability/GHSA-35w5-pcw4-jx94

References

Change history

Field changes observed since this record was first indexed.

Sep 14, 2026Public exploit / PoC published

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#osv#pip#exploit-available

← Back to feed