CVE-2026-47391: PraisonAI Unauth RCE

CISO Take

PraisonAI's official A2A server example exposes a critical remote code execution chain requiring zero credentials: an unauthenticated attacker sends a crafted JSON-RPC POST to the /a2a endpoint, the LLM processes the prompt and invokes the registered calculate() tool, and Python eval() executes arbitrary attacker-controlled code in the server process. This has been confirmed with a real Gemini LLM — not a theoretical proof — writing arbitrary files from a single unauthenticated HTTP request against CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). While only one downstream dependent is currently tracked and this CVE is not in CISA KEV, any organization that deployed the official example verbatim is fully exposed with trivially reproducible exploitation requiring nothing beyond network reach to port 8000. Patch to praisonai >= 4.6.40 immediately, audit all A2A deployments for auth_token configuration and eval()-based tools, and block port 8000 at the network perimeter pending remediation.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

Critical. CVSS 9.8 with no authentication, no user interaction, and network-level access is all that is required. The exploit chain is trivially reproducible: a single JSON-RPC POST to /a2a delivers arbitrary code execution via the LLM acting as a relay to an unsafe eval() sink. The framework's default auth_token=None combined with 0.0.0.0 binding creates a permissive-by-default exposure surface. The real-LLM confirmation with Gemini eliminates any theoretical uncertainty — the LLM autonomously decided to invoke the calculate tool when prompted, confirming that no special jailbreak or adversarial prompt engineering is required. Organizations that deployed AI agent services following this first-party example without security review are fully compromised upon network exposure.

How does the attack unfold?

Initial Access

Attacker discovers PraisonAI A2A service bound to 0.0.0.0:8000 — no auth_token configured, /a2a POST endpoint is open to any network client.

AML.T0049

Prompt Injection

Attacker sends an unauthenticated JSON-RPC message/send POST to /a2a with a prompt instructing the LLM to invoke the calculate tool with a malicious Python expression as the argument.

AML.T0051.000

Tool Invocation

The LLM processes the injected prompt, selects the calculate() tool, and passes the attacker-controlled expression string directly to agent.chat(), which routes it to the eval() sink.

AML.T0053

Code Execution & Impact

eval() executes arbitrary Python in the server process, enabling credential exfiltration from environment variables, filesystem access, reverse shell deployment, or lateral movement.

AML.T0050

Initial Access

Attacker discovers PraisonAI A2A service bound to 0.0.0.0:8000 — no auth_token configured, /a2a POST endpoint is open to any network client.

AML.T0049

Prompt Injection

Attacker sends an unauthenticated JSON-RPC message/send POST to /a2a with a prompt instructing the LLM to invoke the calculate tool with a malicious Python expression as the argument.

AML.T0051.000

Tool Invocation

The LLM processes the injected prompt, selects the calculate() tool, and passes the attacker-controlled expression string directly to agent.chat(), which routes it to the eval() sink.

AML.T0053

Code Execution & Impact

eval() executes arbitrary Python in the server process, enabling credential exfiltration from environment variables, filesystem access, reverse shell deployment, or lateral movement.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 4.6.39	`4.6.40`
1 dependents 69% patched ~13d to patch Full package profile →
PraisonAI Agents	pip	—	No patch
20 dependents 67% patched ~6d to patch Full package profile →

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

1.2%

chance of exploitation in 30 days

Higher than 65% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch immediately: upgrade to praisonai >= 4.6.40 and praisonaiagents to the corresponding patched release.
Audit all A2A deployments: confirm auth_token is explicitly configured before any 0.0.0.0 binding; treat auth_token=None plus public bind as a deployment blocker.
Eliminate unsafe tools: remove or replace eval()-based tools with safe arithmetic parsers (ast.literal_eval for literals or a sandboxed expression evaluator such as simpleeval); treat any tool wrapping eval(), exec(), subprocess, os.system, or file-write operations as high-risk.
Restrict network exposure: rebind A2A services to 127.0.0.1 for local-only use; apply firewall rules blocking port 8000 from untrusted networks if external access is required.
Detection: scan running PraisonAI processes for A2A services bound to 0.0.0.0 without an auth_token; grep deployed tool definitions for eval(, exec(, subprocess, and os.system; review A2A task history for anomalous payloads.
Post-patch verification: confirm /a2a returns 401 for unauthenticated requests and that no deployed tool retains eval() logic.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Prompt Injection Agent Framework Plugin AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0051.000 - Direct AML.T0053 - AI Agent Tool Invocation AML.T0055 - Unsecured Credentials AML.T0086 - Exfiltration via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.6.1.6 - Processes to identify and address security risks to the AI system

NIST AI RMF

GOVERN 1.2 - Policies and processes for AI risk management

OWASP LLM Top 10

LLM01 - Prompt Injection LLM02 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-47391?

PraisonAI's official A2A server example exposes a critical remote code execution chain requiring zero credentials: an unauthenticated attacker sends a crafted JSON-RPC POST to the /a2a endpoint, the LLM processes the prompt and invokes the registered calculate() tool, and Python eval() executes arbitrary attacker-controlled code in the server process. This has been confirmed with a real Gemini LLM — not a theoretical proof — writing arbitrary files from a single unauthenticated HTTP request against CVSS 9.8 (AV:N/AC:L/PR:N/UI:N). While only one downstream dependent is currently tracked and this CVE is not in CISA KEV, any organization that deployed the official example verbatim is fully exposed with trivially reproducible exploitation requiring nothing beyond network reach to port 8000. Patch to praisonai >= 4.6.40 immediately, audit all A2A deployments for auth_token configuration and eval()-based tools, and block port 8000 at the network perimeter pending remediation.

Is CVE-2026-47391 actively exploited?

No confirmed active exploitation of CVE-2026-47391 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47391?

1. Patch immediately: upgrade to praisonai >= 4.6.40 and praisonaiagents to the corresponding patched release. 2. Audit all A2A deployments: confirm auth_token is explicitly configured before any 0.0.0.0 binding; treat auth_token=None plus public bind as a deployment blocker. 3. Eliminate unsafe tools: remove or replace eval()-based tools with safe arithmetic parsers (ast.literal_eval for literals or a sandboxed expression evaluator such as simpleeval); treat any tool wrapping eval(), exec(), subprocess, os.system, or file-write operations as high-risk. 4. Restrict network exposure: rebind A2A services to 127.0.0.1 for local-only use; apply firewall rules blocking port 8000 from untrusted networks if external access is required. 5. Detection: scan running PraisonAI processes for A2A services bound to 0.0.0.0 without an auth_token; grep deployed tool definitions for eval(, exec(, subprocess, and os.system; review A2A task history for anomalous payloads. 6. Post-patch verification: confirm /a2a returns 401 for unauthenticated requests and that no deployed tool retains eval() logic.

What systems are affected by CVE-2026-47391?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, agentic AI services, AI agent tool integrations.

What is the CVSS score for CVE-2026-47391?

CVE-2026-47391 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 1.17%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemsagentic AI servicesAI agent tool integrations

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0051.000 Direct

AML.T0053 AI Agent Tool Invocation

AML.T0055 Unsecured Credentials

AML.T0086 Exfiltration via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.6

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM01, LLM02

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can invoke the registered `calculate` tool. In testing with `gemini/gemini-2.5-flash-lite`, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.

Exploitation Scenario

An adversary performs automated scanning for open port 8000 services and probes for PraisonAI A2A JSON-RPC responses. Upon identifying a target, they send a single unauthenticated POST to /a2a with a message/send payload containing a prompt instructing the LLM to invoke the calculate tool with a Python expression that reads /proc/self/environ and POSTs the contents — including GEMINI_API_KEY, OPENAI_API_KEY, and database credentials — to an attacker-controlled server via urllib. The real LLM, following the prompt's instruction, invokes the calculate tool; eval() executes the payload. In under one HTTP round trip and with no authentication, the adversary harvests all API credentials from the server's environment, then optionally writes a reverse shell to a cron path or injects a backdoor into a loaded Python module for persistence — all from an unauthenticated network position.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function Primary CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') Primary CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') Primary CWE-306 Missing Authentication for Critical Function CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.