CVE-2026-47396
Received Received - Intake

Unauthenticated Remote Agent Control in PraisonAI

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-47396
EUVD
EUVD-2026-46304

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
praisonai praisonai to 4.6.40 (exc)
mervinpraison praisonai to 4.6.40 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects PraisonAI versions up to 4.6.39. When the CALL_SERVER_TOKEN environment variable is not set, the call server exposes an unauthenticated agent control API. This allows any client to access sensitive endpoints without authentication, including listing agents, retrieving metadata, invoking agents, and unregistering agents.

Detection Guidance

Check if the call server is running without CALL_SERVER_TOKEN by inspecting environment variables and listening ports. Use commands like 'netstat -tulnp | grep 0.0.0.0' or 'ss -tulnp | grep 0.0.0.0' to see if the call server is bound to all interfaces. Verify if the API endpoints are accessible without authentication by attempting unauthenticated requests to agent control endpoints.

Check PraisonAI version with 'pip show praisonai' or 'praisonai --version'. If version is below 4.6.40, the system is vulnerable. Inspect logs for call server startup warnings about missing CALL_SERVER_TOKEN.

Impact Analysis

An attacker could exploit this to enumerate agents, read sensitive instructions, execute agents, trigger external integrations, consume resources, or disrupt availability. The call server binds to all network interfaces, making the API accessible remotely if authentication is not configured.

Compliance Impact

This vulnerability exposes an unauthenticated agent control API, allowing unauthorized access to sensitive operations like listing agents, retrieving metadata, and invoking agents. This could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.40 or later immediately. Set the CALL_SERVER_TOKEN environment variable to a strong, unique value before starting the call server. Bind the call server to localhost (127.0.0.1) instead of 0.0.0.0 to restrict access.

Review and audit all agent control API endpoints for unauthorized access. Implement network-level controls to block unauthorized access to the call server ports. Monitor for any suspicious activity or unauthorized agent invocations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47396. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart