2026-04-03 · 2026-Q2
PraisonAI Gateway Unauthenticated Agent Control
PrimaryL6Identity / Run
- Fixable:
- Yes, vendor patch
- Vendor response:
- Unknown
- In the wild:
- No
- Actor:
- Attacker
Target
PraisonAI Gateway
Impact
Any network client can enumerate agents and send arbitrary messages via unauthenticated WebSocket
Root Cause
No authentication on WebSocket and agent topology endpoints