CVE-2026-47410: PraisonAI hardcoded JWT → full

CISO Take

PraisonAI Platform's authentication service ships with a hardcoded JWT signing secret ('dev-secret-change-me') as its default, and the safety guard meant to catch this is silently bypassed because PLATFORM_ENV also defaults to 'dev' — meaning a standard pip install plus uvicorn launch is fully exploitable with zero operator warning. Any attacker who reads the public GitHub source can forge valid JWTs for arbitrary user IDs, impersonating workspace owners and administrators with no prior authentication whatsoever. The package carries 59 other CVEs in the same codebase and has at least one downstream dependent, amplifying the blast radius across AI agent deployments built on this platform. Upgrade immediately to praisonai-platform >= 0.1.4; if patching is not immediately possible, explicitly set PLATFORM_JWT_SECRET to a cryptographically strong random value and PLATFORM_ENV to any non-'dev' string, then rotate all existing sessions.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

Critical. CVSS 9.8 with a network-accessible attack vector, zero required privileges, and no user interaction needed. Exploitation is trivial — the signing key is publicly visible in the GitHub repository and a working exploit requires four lines of Python using the standard PyJWT library. Any internet-exposed praisonai-platform deployment running <= 0.1.2 without explicitly configured secrets is fully compromised. The default deployment path (pip install + uvicorn) hits this condition with no warning emitted. No confirmed public PoC repository has been indexed, but the exploit chain is elementary enough that any attacker with basic scripting skills can reproduce it within minutes of reading the advisory.

How does the attack unfold?

Reconnaissance

Attacker reads auth_service.py from the public MervinPraison/PraisonAI GitHub repository and extracts the hardcoded JWT signing secret 'dev-secret-change-me'.

AML.T0095.000

Initial Access

Attacker identifies a live internet-exposed praisonai-platform instance via Shodan and registers a free account to confirm the deployment is unpatched and to observe the user UUID format.

AML.T0049

Credential Forgery

Attacker forges a JWT signed with the known hardcoded secret and the target workspace owner's UUID as the sub claim, bypassing all authentication checks with four lines of Python.

AML.T0055

Full Account Takeover

Forged JWT passes _verify_token HMAC validation and grants attacker full authenticated access as any target user, enabling data exfiltration, agent configuration manipulation, and workspace destruction.

AML.T0012

Reconnaissance

Attacker reads auth_service.py from the public MervinPraison/PraisonAI GitHub repository and extracts the hardcoded JWT signing secret 'dev-secret-change-me'.

AML.T0095.000

Initial Access

Attacker identifies a live internet-exposed praisonai-platform instance via Shodan and registers a free account to confirm the deployment is unpatched and to observe the user UUID format.

AML.T0049

Credential Forgery

Attacker forges a JWT signed with the known hardcoded secret and the target workspace owner's UUID as the sub claim, bypassing all authentication checks with four lines of Python.

AML.T0055

Full Account Takeover

Forged JWT passes _verify_token HMAC validation and grants attacker full authenticated access as any target user, enabling data exfiltration, agent configuration manipulation, and workspace destruction.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 0.1.2	`0.1.4`
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Upgrade praisonai-platform to >= 0.1.4 immediately — this release inverts the guard to fail-closed.
Workaround if patching is blocked: Set PLATFORM_JWT_SECRET to a cryptographically random string of at least 32 bytes AND set PLATFORM_ENV to any value other than 'dev'; both variables must be set because the original guard requires both conditions.
Rotate all sessions: After patching or applying the workaround, rotate PLATFORM_JWT_SECRET to invalidate all tokens issued under the hardcoded secret — any token previously issued must be considered compromised.
Detection: Audit authentication logs for JWTs whose sub claim does not correspond to a registration event, or for successful /auth/me calls originating from unexpected source IPs.
Network hardening: If praisonai-platform is not intended to be internet-facing, apply firewall rules to restrict API access to trusted networks while patching proceeds.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials AML.T0095.000 - Code Repositories

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system security

NIST AI RMF

GOVERN-1.7 - Processes and safeguards for AI risk management

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-47410?

PraisonAI Platform's authentication service ships with a hardcoded JWT signing secret ('dev-secret-change-me') as its default, and the safety guard meant to catch this is silently bypassed because PLATFORM_ENV also defaults to 'dev' — meaning a standard pip install plus uvicorn launch is fully exploitable with zero operator warning. Any attacker who reads the public GitHub source can forge valid JWTs for arbitrary user IDs, impersonating workspace owners and administrators with no prior authentication whatsoever. The package carries 59 other CVEs in the same codebase and has at least one downstream dependent, amplifying the blast radius across AI agent deployments built on this platform. Upgrade immediately to praisonai-platform >= 0.1.4; if patching is not immediately possible, explicitly set PLATFORM_JWT_SECRET to a cryptographically strong random value and PLATFORM_ENV to any non-'dev' string, then rotate all existing sessions.

Is CVE-2026-47410 actively exploited?

No confirmed active exploitation of CVE-2026-47410 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47410?

1. Patch: Upgrade praisonai-platform to >= 0.1.4 immediately — this release inverts the guard to fail-closed. 2. Workaround if patching is blocked: Set PLATFORM_JWT_SECRET to a cryptographically random string of at least 32 bytes AND set PLATFORM_ENV to any value other than 'dev'; both variables must be set because the original guard requires both conditions. 3. Rotate all sessions: After patching or applying the workaround, rotate PLATFORM_JWT_SECRET to invalidate all tokens issued under the hardcoded secret — any token previously issued must be considered compromised. 4. Detection: Audit authentication logs for JWTs whose sub claim does not correspond to a registration event, or for successful /auth/me calls originating from unexpected source IPs. 5. Network hardening: If praisonai-platform is not intended to be internet-facing, apply firewall rules to restrict API access to trusted networks while patching proceeds.

What systems are affected by CVE-2026-47410?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, AI agent orchestration.

What is the CVSS score for CVE-2026-47410?

CVE-2026-47410 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.64%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI platformsAI agent orchestration

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

AML.T0095.000 Code Repositories

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2

NIST AI RMF: GOVERN-1.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev-secret-change-me"` when `PLATFORM_JWT_SECRET` is unset. A safety check exists but only fires when `PLATFORM_ENV != "dev"`; the default value of `PLATFORM_ENV` is `"dev"`, so the check is silently bypassed in any deployment that does not explicitly opt out. The attacker reads the literal from this public source file, mints a JWT with arbitrary `sub` and `email` claims, and authenticates as any existing user (including workspace owners and admins). PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

An adversary targeting AI agent infrastructure scans Shodan or Censys for FastAPI instances exposing the /auth/me route or the praisonai_platform user-agent string. After confirming a live target, the attacker retrieves auth_service.py line 25 from the public MervinPraison/PraisonAI GitHub repository to obtain the signing secret. They register a free account on the target deployment to confirm it is unpatched and to observe the UUID format used for user identifiers. They enumerate a workspace owner's UUID through companion IDOR vulnerabilities documented in separate advisories for the same package. With four lines of Python and the standard PyJWT library, the attacker forges a JWT signed with 'dev-secret-change-me' and the owner's UUID as the sub claim. The platform's _verify_token function validates the HMAC-SHA256 signature, returns an AuthIdentity for the victim, and grants the attacker full authenticated access. The entire attack chain requires no specialized AI or cryptographic expertise and can be completed in under five minutes.