CVE-2026-47393
Received Received - Intake

PraisonAI Default Authentication Bypass in API Server

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that binds to `0.0.0.0` per the recommended sample YAML, exposes `/chat` and `/agents` endpoints, runs `praisonai.run()` on user-supplied JSON input — LLM orchestration with the API key materials present in the process environment, and does not require any authentication. Versions prior to 4.6.40 still ship the generator with `auth_enabled` defaulting to `False`. The fix shape is opt-in via `APIConfig(auth_enabled=True, auth_token=...)`. Version 4.6.40 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-47393
EUVD
EUVD-2026-46297

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mervinpraison praisonai 4.6.40
mervinpraison praisonai to 4.6.40 (exc)
mervinpraison praisonai 4.6.34
mervinpraison praisonai From 2.5.6 (inc) to 4.6.33 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47393 involves multiple security vulnerabilities in PraisonAI, primarily Insecure Direct Object References (IDOR) and insecure default configurations. The platform's API server and generated Flask servers have authentication disabled by default, allowing unauthenticated access to endpoints like /chat and /agents. Additionally, unsafe input validation in calculator tools and insufficient HTML sanitization expose the system to code injection and XSS risks.

Detection Guidance

Check for running PraisonAI API servers binding to 0.0.0.0 by inspecting network connections with commands like 'netstat -tulnp | grep 8080' or 'ss -tulnp | grep 0.0.0.0'. Look for processes named 'praisonai' or 'python' running API-related scripts. Examine configuration files for 'auth_enabled: false' or 'AUTH_ENABLED = False' settings.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data, execute arbitrary commands via code injection, or consume resources by triggering workflows without authentication. The lack of authentication allows remote users to interact with the API, potentially leading to data breaches or service disruptions.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR's principle of least privilege and HIPAA's safeguards for protected health information. Unauthorized access risks exposing sensitive data, leading to potential legal and regulatory penalties.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.40 or later. If upgrading is not possible, manually set 'auth_enabled=True' and 'auth_token' in APIConfig. Disable the vulnerable API server if not needed. Ensure the 'bleach' dependency is installed for HTML sanitization. Review and restrict network access to the API server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47393. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart