CVE-2026-57128 Details

A vulnerability exists in the PraisonAI SSE server prior to version 1.6.58, where the server does not validate the authentication token before processing requests on the '/publish', '/events', or '/info' endpoints. This oversight allows a network client to send arbitrary events to all connected clients and access sensitive server configuration details, including the number of active client connections. The issue arises because the server's authentication mechanism is not enforced, leaving it open to unauthorized event injection and information leakage.

Users are advised to update to PraisonAI version 1.6.59 or later, where this vulnerability has been patched. In the updated version, the SSE server correctly validates the authentication token before processing requests on the vulnerable endpoints.