CVE-2026-47396: PraisonAI fail-open auth exposes

CISO Take

PraisonAI's call server contains a fail-open authentication defect: when `CALL_SERVER_TOKEN` is absent from the environment, the `verify_token()` dependency returns successfully for every request, leaving all agent-control endpoints—list, inspect, invoke, and unregister agents—open to any unauthenticated caller over the network. With a CVSS score of 9.8 (Critical), no privileges required, and a server that binds to `0.0.0.0` by default, any internet-facing or internally-reachable PraisonAI deployment without an explicit token is a fully open agent control plane. The blast radius extends well beyond information disclosure: the unauthenticated invoke endpoint can trigger downstream tool calls, external API integrations, and privileged actions wired to deployed agents, while the delete endpoint enables denial-of-service by unregistering agents; repeated invocations also drain model and API budget at attacker discretion. Upgrade to `praisonai>=4.6.40` immediately; if patching cannot be applied at once, set `CALL_SERVER_TOKEN` to a cryptographically random value and restrict the call server port to trusted network ranges at the firewall level.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical risk. CVSS 9.8 with AV:N/AC:L/PR:N/UI:N places this in the highest exploitability tier: any network client can reach the endpoint with a single HTTP request and no credentials. The fail-open default means the vulnerable state is the out-of-the-box configuration unless the operator explicitly sets an environment variable — a high probability of exposure in quick-start and development deployments that drift into production. With 59 prior CVEs in the same package and only 1 downstream dependent tracked, the direct supply-chain blast radius is moderate, but the attack surface for operators running the call server without a token is fully external-network-accessible.

How does the attack unfold?

Initial Access

Adversary scans for exposed PraisonAI call server ports on the internet or internal network and discovers an open endpoint accepting unauthenticated HTTP requests.

AML.T0049

Agent Discovery

Unauthenticated GET /api/v1/agents enumerates all registered agents; follow-up GET /api/v1/agents/{id} retrieves each agent's instruction text, tool definitions, and metadata.

AML.T0084

Agent Invocation

Adversary issues POST /api/v1/agents/{id}/invoke with attacker-controlled input, executing the target agent and triggering its connected downstream tools, external API calls, or privileged integrations.

AML.T0053

Impact

Adversary exfiltrates agent instruction text and secrets, exhausts model API budget via repeated invocations, triggers unauthorized actions via agent tools, or disrupts availability by unregistering agents via DELETE /api/v1/agents/{id}.

AML.T0034.002

Initial Access

Adversary scans for exposed PraisonAI call server ports on the internet or internal network and discovers an open endpoint accepting unauthenticated HTTP requests.

AML.T0049

Agent Discovery

Unauthenticated GET /api/v1/agents enumerates all registered agents; follow-up GET /api/v1/agents/{id} retrieves each agent's instruction text, tool definitions, and metadata.

AML.T0084

Agent Invocation

Adversary issues POST /api/v1/agents/{id}/invoke with attacker-controlled input, executing the target agent and triggering its connected downstream tools, external API calls, or privileged integrations.

AML.T0053

Impact

Adversary exfiltrates agent instruction text and secrets, exhausts model API budget via repeated invocations, triggers unauthorized actions via agent tools, or disrupts availability by unregistering agents via DELETE /api/v1/agents/{id}.

AML.T0034.002

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 4.6.39	`4.6.40`
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

PATCH

Upgrade to praisonai>=4.6.40 which addresses the fail-open authentication defect.
WORKAROUND (if patching is delayed): Set a strong random CALL_SERVER_TOKEN environment variable before starting the call server (export CALL_SERVER_TOKEN=$(openssl rand -hex 32)).
NETWORK CONTROLS

Restrict the call server port to trusted source IPs at the firewall or network policy layer. Do not expose the call server port directly to the internet.
DETECTION

Scan your environment for praisonai-call processes and confirm CALL_SERVER_TOKEN is set. Query GET /api/v1/agents from an unauthenticated client — a 200 response confirms exposure. Review access logs for unexpected calls to /api/v1/agents paths.
REGRESSION

After patching, verify that all agent-control endpoints return 401 Unauthorized when no valid token is supplied.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Data Extraction Agent API Framework AML.T0002.002 - AI Agent Configuration AML.T0034.002 - Agentic Resource Consumption AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084 - Discover AI Agent Configuration AML.T0108 - AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

A.6.2.2 - Information access restriction A.9.4.1 - Information access restriction for application functions

NIST AI RMF

GOVERN 1.1 - Policies and processes for AI risk management MANAGE 2.2 - Mechanisms to protect and remediate AI system vulnerabilities

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47396?

PraisonAI's call server contains a fail-open authentication defect: when `CALL_SERVER_TOKEN` is absent from the environment, the `verify_token()` dependency returns successfully for every request, leaving all agent-control endpoints—list, inspect, invoke, and unregister agents—open to any unauthenticated caller over the network. With a CVSS score of 9.8 (Critical), no privileges required, and a server that binds to `0.0.0.0` by default, any internet-facing or internally-reachable PraisonAI deployment without an explicit token is a fully open agent control plane. The blast radius extends well beyond information disclosure: the unauthenticated invoke endpoint can trigger downstream tool calls, external API integrations, and privileged actions wired to deployed agents, while the delete endpoint enables denial-of-service by unregistering agents; repeated invocations also drain model and API budget at attacker discretion. Upgrade to `praisonai>=4.6.40` immediately; if patching cannot be applied at once, set `CALL_SERVER_TOKEN` to a cryptographically random value and restrict the call server port to trusted network ranges at the firewall level.

Is CVE-2026-47396 actively exploited?

No confirmed active exploitation of CVE-2026-47396 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47396?

1. PATCH: Upgrade to `praisonai>=4.6.40` which addresses the fail-open authentication defect. 2. WORKAROUND (if patching is delayed): Set a strong random `CALL_SERVER_TOKEN` environment variable before starting the call server (`export CALL_SERVER_TOKEN=$(openssl rand -hex 32)`). 3. NETWORK CONTROLS: Restrict the call server port to trusted source IPs at the firewall or network policy layer. Do not expose the call server port directly to the internet. 4. DETECTION: Scan your environment for `praisonai-call` processes and confirm `CALL_SERVER_TOKEN` is set. Query `GET /api/v1/agents` from an unauthenticated client — a 200 response confirms exposure. Review access logs for unexpected calls to `/api/v1/agents` paths. 5. REGRESSION: After patching, verify that all agent-control endpoints return `401 Unauthorized` when no valid token is supplied.

What systems are affected by CVE-2026-47396?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI automation pipelines, agentic tool integrations, voice/call AI systems.

What is the CVSS score for CVE-2026-47396?

CVE-2026-47396 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.64%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationAI automation pipelinesagentic tool integrationsvoice/call AI systems

MITRE ATLAS Techniques

AML.T0002.002 AI Agent Configuration

AML.T0034.002 Agentic Resource Consumption

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084 Discover AI Agent Configuration

AML.T0108 AI Agent

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: A.6.2.2, A.9.4.1

NIST AI RMF: GOVERN 1.1, MANAGE 2.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.

Exploitation Scenario

An adversary performs an internet-wide or internal-network scan targeting the default PraisonAI call server port. Upon discovering an open endpoint, they issue an unauthenticated `GET /api/v1/agents` to enumerate all registered agents, including their names, types, and instruction text. They identify a high-value agent wired to an internal ticketing system or cloud API. They then issue `POST /api/v1/agents/{agent_id}/invoke` with a crafted message designed to trigger a privileged tool call — for example, creating records, exfiltrating data, or sending communications via a connected integration. In parallel, they issue repeated invocations to exhaust the operator's model API budget. Finally, they issue `DELETE /api/v1/agents/{agent_id}` to unregister critical agents, disrupting availability. No credentials, no prior access, no AI or ML expertise required — only the ability to send HTTP requests.

Weaknesses (CWE)

CWE-284 Improper Access Control Primary CWE-284 Improper Access Control Primary CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function Primary CWE-284 Improper Access Control CWE-306 Missing Authentication for Critical Function

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.