CVE-2026-47393: PraisonAI auth bypass

Q: Is CVE-2026-47393 actively exploited?

No confirmed active exploitation of CVE-2026-47393 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47393?

1. Upgrade to praisonai 4.6.40 (patched version). 2. Regenerate all existing API server code — upgrading the package alone does NOT fix already-generated Flask server files; redeploy with an explicit auth config. 3. Redeploy using APIConfig(auth_enabled=True, auth_token=os.environ['PRAISON_API_TOKEN']) passed to generate_api_server_code(). 4. For deployments that cannot be patched immediately: restrict port 8005 (default) to trusted IP ranges via firewall rules; do not leave the server bound to 0.0.0.0 on internet-accessible hosts. 5. Rotate all LLM API keys (OpenAI, Anthropic, etc.) co-located with PraisonAI deployments that were publicly reachable. 6. Audit internal network for exposed TCP 8005 using vulnerability scanners. 7. Review web server access logs for unauthenticated POST requests to /chat or /agents from unexpected source IPs.

Q: What systems are affected by CVE-2026-47393?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, self-hosted AI API gateways, multi-agent systems.

Q: What is the CVSS score for CVE-2026-47393?

CVE-2026-47393 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.78%.

CISO Take

PraisonAI's deploy command generates a Flask API server with authentication disabled by default, meaning any operator who follows the vendor quickstart gets a network-reachable service on 0.0.0.0 that accepts unauthenticated POST requests to /chat and /agents and routes them directly into praisonai.run() — with LLM API keys live in the process environment. The CVSS score is 9.8 (AV:N/AC:L/PR:N/UI:N), exploitation requires nothing beyond an HTTP client, and the fix is opt-in rather than the new default, meaning deployed servers generated before upgrading remain vulnerable even after a package update. The blast radius extends well beyond credential theft: PraisonAI agents commonly include python_repl, bash, and file I/O tools, so an unauthenticated caller can achieve arbitrary code execution on the host while billing all LLM API costs to the operator. Upgrade to praisonai 4.6.40 immediately, regenerate any existing server code, and rotate all LLM API keys co-located with affected deployments.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical. CVSS 9.8 with network-accessible attack vector, no credentials required, no user interaction. The vulnerability is trivially exploitable — any HTTP client can hit the unauthenticated endpoints with zero domain knowledge. Critically, upgrading the package alone does not remediate existing deployments: the insecure default is baked into already-generated Flask server files, which must be explicitly regenerated with auth_enabled=True. The package carries 59 prior CVEs, signaling a pattern of insecure defaults that adversaries actively track. AI agent deployments are disproportionately exposed because they frequently run on developer machines or small cloud instances with permissive egress firewall rules and LLM API keys available in the process environment.

How does the attack unfold?

Discovery

Adversary scans for open TCP port 8005 on internet-facing or internal hosts and fingerprints PraisonAI Flask API servers by probing the /chat endpoint.

AML.T0006

Auth Bypass

Adversary sends unauthenticated POST to /chat or /agents; check_auth() unconditionally returns True, granting full API access with no credentials or prior knowledge required.

AML.T0049

Credential Harvest

Adversary crafts a prompt instructing the agent to enumerate and return process environment variables, extracting LLM API keys (OpenAI, Anthropic, etc.) stored in the deployment environment.

AML.T0083

Code Execution & Impact

Adversary invokes python_repl or bash agent tools via /agents to achieve remote code execution on the host, while simultaneously consuming the operator's LLM API credit through parallel high-volume requests.

AML.T0053

Discovery

Adversary scans for open TCP port 8005 on internet-facing or internal hosts and fingerprints PraisonAI Flask API servers by probing the /chat endpoint.

AML.T0006

Auth Bypass

Adversary sends unauthenticated POST to /chat or /agents; check_auth() unconditionally returns True, granting full API access with no credentials or prior knowledge required.

AML.T0049

Credential Harvest

Adversary crafts a prompt instructing the agent to enumerate and return process environment variables, extracting LLM API keys (OpenAI, Anthropic, etc.) stored in the deployment environment.

AML.T0083

Code Execution & Impact

Adversary invokes python_repl or bash agent tools via /agents to achieve remote code execution on the host, while simultaneously consuming the operator's LLM API credit through parallel high-volume requests.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 4.6.39	`4.6.40`
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

7 steps

Upgrade to praisonai 4.6.40 (patched version).
Regenerate all existing API server code — upgrading the package alone does NOT fix already-generated Flask server files; redeploy with an explicit auth config.
Redeploy using APIConfig(auth_enabled=True, auth_token=os.environ['PRAISON_API_TOKEN']) passed to generate_api_server_code().
For deployments that cannot be patched immediately: restrict port 8005 (default) to trusted IP ranges via firewall rules; do not leave the server bound to 0.0.0.0 on internet-accessible hosts.
Rotate all LLM API keys (OpenAI, Anthropic, etc.) co-located with PraisonAI deployments that were publicly reachable.
Audit internal network for exposed TCP 8005 using vulnerability scanners.
Review web server access logs for unauthenticated POST requests to /chat or /agents from unexpected source IPs.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Data Leakage Agent Framework API AML.T0034.002 - Agentic Resource Consumption AML.T0040 - AI Model Inference API Access AML.T0048.000 - Financial Harm AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.1.3 - Access control for AI systems

NIST AI RMF

GOVERN 1.1 - Policies and procedures for AI risk management MANAGE 2.2 - Mechanisms for managing AI risks

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47393?

PraisonAI's deploy command generates a Flask API server with authentication disabled by default, meaning any operator who follows the vendor quickstart gets a network-reachable service on 0.0.0.0 that accepts unauthenticated POST requests to /chat and /agents and routes them directly into praisonai.run() — with LLM API keys live in the process environment. The CVSS score is 9.8 (AV:N/AC:L/PR:N/UI:N), exploitation requires nothing beyond an HTTP client, and the fix is opt-in rather than the new default, meaning deployed servers generated before upgrading remain vulnerable even after a package update. The blast radius extends well beyond credential theft: PraisonAI agents commonly include python_repl, bash, and file I/O tools, so an unauthenticated caller can achieve arbitrary code execution on the host while billing all LLM API costs to the operator. Upgrade to praisonai 4.6.40 immediately, regenerate any existing server code, and rotate all LLM API keys co-located with affected deployments.

Is CVE-2026-47393 actively exploited?

No confirmed active exploitation of CVE-2026-47393 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47393?

1. Upgrade to praisonai 4.6.40 (patched version). 2. Regenerate all existing API server code — upgrading the package alone does NOT fix already-generated Flask server files; redeploy with an explicit auth config. 3. Redeploy using APIConfig(auth_enabled=True, auth_token=os.environ['PRAISON_API_TOKEN']) passed to generate_api_server_code(). 4. For deployments that cannot be patched immediately: restrict port 8005 (default) to trusted IP ranges via firewall rules; do not leave the server bound to 0.0.0.0 on internet-accessible hosts. 5. Rotate all LLM API keys (OpenAI, Anthropic, etc.) co-located with PraisonAI deployments that were publicly reachable. 6. Audit internal network for exposed TCP 8005 using vulnerability scanners. 7. Review web server access logs for unauthenticated POST requests to /chat or /agents from unexpected source IPs.

What systems are affected by CVE-2026-47393?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, self-hosted AI API gateways, multi-agent systems.

What is the CVSS score for CVE-2026-47393?

CVE-2026-47393 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.78%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelinesself-hosted AI API gatewaysmulti-agent systems

MITRE ATLAS Techniques

AML.T0034.002 Agentic Resource Consumption

AML.T0040 AI Model Inference API Access

AML.T0048.000 Financial Harm

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.1.3

NIST AI RMF: GOVERN 1.1, MANAGE 2.2

OWASP LLM Top 10: LLM05, LLM08

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that binds to `0.0.0.0` per the recommended sample YAML, exposes `/chat` and `/agents` endpoints, runs `praisonai.run()` on user-supplied JSON input — LLM orchestration with the API key materials present in the process environment, and does not require any authentication. Versions prior to 4.6.40 still ship the generator with `auth_enabled` defaulting to `False`. The fix shape is opt-in via `APIConfig(auth_enabled=True, auth_token=...)`. Version 4.6.40 fixes the issue.

Exploitation Scenario

An adversary scans the internet or internal corporate network for open TCP port 8005 and identifies PraisonAI Flask servers by fingerprinting the /chat endpoint response. A trivial POST with JSON payload {'message': 'list all environment variables'} is accepted without authentication — check_auth() returns True unconditionally. The adversary extracts the operator's LLM API keys from the process environment via a second crafted prompt, then opens a parallel channel to invoke those keys at high volume from attacker infrastructure, billing thousands of dollars to the victim. In parallel, a crafted /agents request instructs the agent to use the python_repl tool to execute a reverse shell payload, achieving persistent remote code execution on the host running PraisonAI and providing a foothold to pivot into internal systems or exfiltrate data accessible to that host.

Weaknesses (CWE)

CWE-1188 Initialization of a Resource with an Insecure Default Primary CWE-1188 Initialization of a Resource with an Insecure Default Primary CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function Primary CWE-1188 Initialization of a Resource with an Insecure Default CWE-306 Missing Authentication for Critical Function

CWE-1188 — Initialization of a Resource with an Insecure Default: The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Source: MITRE CWE corpus.