CVE-2026-47394: PraisonAI Information Disclosure Flaw

CVE-2026-47394 Overview

CVE-2026-47394 is a path traversal vulnerability [CWE-22] in PraisonAI, a multi-agent teams system. The flaw exists in Model Context Protocol (MCP) tool handlers within mcp_server/adapters/cli_tools.py. The issue represents an incomplete fix for the prior advisory GHSA-9mqq-jqxf-grvw / CVE-2026-44336. The earlier patch introduced a _resolve_rule_path() helper for rules.create, rules.show, and rules.delete, but left workflow.show, workflow.validate, and deploy.validate unchanged. The MCP dispatcher at server.py:281-298 still accepts unvalidated **kwargs from params["arguments"] without enforcing the tool's declared input_schema. Version 4.6.40 contains the corrected fix.

Critical Impact
An unauthenticated attacker can issue a single MCP tools/call to praisonai.workflow.show and read any file accessible to the host user, including /etc/passwd, ~/.ssh/id_rsa, ~/.aws/credentials, and project .env files.

Affected Products

PraisonAI versions prior to 4.6.40
MCP server component mcp_server/adapters/cli_tools.py
MCP dispatcher server.py (lines 281-298)

Discovery Timeline

2026-07-21 - CVE-2026-47394 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-47394

Vulnerability Analysis

The vulnerability stems from missing path validation across MCP tool handlers in PraisonAI. The prior fix commit 68cc9427 added a _resolve_rule_path() helper and applied it only to rules.create, rules.show, and rules.delete. Three adjacent handlers, workflow.show, workflow.validate, and deploy.validate, share the same file-handling pattern but were not hardened. Attackers can supply arbitrary paths through the unpatched handlers to read files outside the intended workflow directory.

The MCP dispatcher accepts raw **kwargs from params["arguments"] and forwards them to handlers without validating against each tool's declared input_schema. This means schema-based input constraints defined for MCP tools are never enforced at runtime. Any parameter name or value the client supplies reaches the handler unchecked.

Root Cause

The root cause is twofold. First, the incomplete remediation of the prior CVE left three handlers without the _resolve_rule_path() sanitization step that normalizes and confines paths. Second, the dispatcher provides no defense in depth: it does not reject unexpected keys or reject values that violate the tool schema. Together these defects allow directory traversal sequences and absolute paths to flow directly into file-read operations.

Attack Vector

Exploitation requires no authentication and no user interaction. A remote attacker sends one MCP tools/call request naming praisonai.workflow.show with an arguments object pointing to a target path. The handler opens and returns the file contents. Because the dispatcher does not enforce the input_schema, attackers can also pass unexpected parameter names to reach code paths that would otherwise be inaccessible.

python

# Security hardening from PR #1684 (commit b0d8f777) - URL mention validation
def _process_url_mention(self, url: str) -> Optional[str]:
    """Process @url:https://... mention."""
    try:
        from praisonaiagents.tools.spider_tools import SpiderTools

        if not SpiderTools()._validate_url(url):
            return f"# URL: {url}\n[Blocked: URL is not allowed]"

        import urllib.request

        req = urllib.request.Request(
# Source: https://github.com/MervinPraison/PraisonAI/commit/b0d8f777528f3253a0cfb0a3ef65455da6ae32f6

The patch above illustrates the broader input-validation hardening pattern applied in the same release, where untrusted inputs are validated before reaching downstream file or network operations.

Detection Methods for CVE-2026-47394

Indicators of Compromise

MCP tools/call requests targeting praisonai.workflow.show, praisonai.workflow.validate, or praisonai.deploy.validate with path-like arguments values.
Argument values containing directory traversal sequences such as ../, absolute paths starting with /etc/, /root/, or references to ~/.ssh/, ~/.aws/, or .env.
MCP server responses that return file contents matching system files (for example, lines starting with root:x:0:0: from /etc/passwd).
PraisonAI process access to files outside the expected workflow or project directories.

Detection Strategies

Log and inspect every MCP tools/call payload, focusing on the name and arguments fields for the four handlers named in GHSA-9cr9-25q5-8prj.
Alert on responses from the MCP server that contain signatures of sensitive files, such as private key headers (-----BEGIN OPENSSH PRIVATE KEY-----) or AWS credential markers (aws_access_key_id).
Use file integrity and access monitoring on the PraisonAI host to flag reads of ~/.ssh, ~/.aws, and /etc/shadow by the PraisonAI process.

Monitoring Recommendations

Enable verbose MCP server logging and forward events to a central log platform for correlation.
Track the running PraisonAI version and confirm all deployments are at 4.6.40 or later.
Monitor outbound traffic from the PraisonAI host for unusual exfiltration following any suspicious MCP call.

How to Mitigate CVE-2026-47394

Immediate Actions Required

Upgrade PraisonAI to version 4.6.40 or later, which contains the corrected fix for all affected handlers.
Restrict network exposure of the MCP server so that only trusted clients can reach tools/call endpoints.
Run the PraisonAI process as a low-privilege account that cannot read SSH keys, cloud credentials, or .env files belonging to other users.
Rotate any secrets (SSH keys, cloud API keys, .env values) that were readable by the PraisonAI host user if exposure is suspected.

Patch Information

The fix ships in PraisonAI 4.6.40. Review the GitHub Security Advisory GHSA-9cr9-25q5-8prj, GitHub Pull Request #1684, and the GitHub Commit Changes for the full remediation. The corrected release extends the _resolve_rule_path() helper pattern to workflow.show, workflow.validate, and deploy.validate.

Workarounds

Disable or firewall the MCP server until the upgrade is applied.
Remove or restrict the vulnerable tools by editing mcp_server/adapters/cli_tools.py to reject absolute paths and traversal sequences in workflow.show, workflow.validate, and deploy.validate.
Confine the PraisonAI process using containerization, chroot, or systemd ProtectHome= and ReadOnlyPaths= directives to limit filesystem reach.

bash

# Upgrade PraisonAI to the patched release
pip install --upgrade "praisonai>=4.6.40"

# Verify installed version
python -c "import praisonai; print(praisonai.__version__)"