CVE-2026-47396: PraisonAI Auth Bypass Vulnerability

CVE-2026-47396 Overview

CVE-2026-47396 is a critical authentication bypass vulnerability in PraisonAI, a multi-agent teams framework. Versions prior to 4.6.40 ship a call server that exposes the praisonai.api.agent_invoke router without authentication when the CALL_SERVER_TOKEN environment variable is not set. The verify_token() helper fails open in this configuration, granting any network-reachable client full access to the agent control plane. Because the bundled call server binds to 0.0.0.0, operators who launch it without explicitly configuring a token unintentionally publish an unauthenticated remote agent control API. Attackers can list agents, inspect metadata and instructions, invoke agents, and unregister them. The issue is fixed in version 4.6.40.

Critical Impact
Unauthenticated remote attackers can enumerate, invoke, and unregister PraisonAI agents on any exposed call server instance, resulting in full compromise of the agent control plane.

Affected Products

PraisonAI versions prior to 4.6.40
praisonai.api.call bundled call server component
praisonai.api.agent_invoke router endpoints

Discovery Timeline

2026-07-21 - CVE-2026-47396 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-47396

Vulnerability Analysis

The vulnerability resides in the authentication helper verify_token() used by the praisonai.api.agent_invoke router. When the CALL_SERVER_TOKEN environment variable is unset, verify_token() returns success instead of rejecting the request. Every sensitive agent-control endpoint depends on this helper, so the failure mode propagates across the entire API surface. The bundled call server includes the vulnerable router and binds the listener to 0.0.0.0, exposing it to all network interfaces by default. This maps to CWE-284: Improper Access Control.

Root Cause

The root cause is fail-open authentication logic. Instead of denying access when the shared secret is missing, verify_token() treats the absent token as a bypass condition. Secure designs must default to denying access when required credentials cannot be validated. Combining this fail-open path with a listener bound to 0.0.0.0 turns a configuration oversight into a remotely exploitable exposure.

Attack Vector

An attacker with network reachability to the call server sends unauthenticated HTTP requests to the agent control endpoints. No prior credentials, user interaction, or elevated privileges are required. Successful requests allow the attacker to enumerate registered agents through the list endpoint, extract system prompts and instructions through the metadata endpoints, drive agents by invoking arbitrary tasks, and remove agents by calling the unregister endpoint. Because agent instructions frequently contain sensitive business context and prompt engineering, disclosure alone can be damaging.

The upstream fix landed in commit ef79b7a0561796ad9807f0f09538c25cc78d3619. See the GitHub Security Advisory GHSA-86qc-r5v2-v6x6 for authoritative details.

Detection Methods for CVE-2026-47396

Indicators of Compromise

Unauthenticated HTTP requests to praisonai.api.agent_invoke routes such as agent listing, metadata inspection, invocation, and unregister endpoints.
Call server processes launched without the CALL_SERVER_TOKEN environment variable set.
Listeners on 0.0.0.0 exposing PraisonAI call server ports to non-loopback interfaces.
Unexpected agent unregister events or invocations originating from external source addresses.

Detection Strategies

Audit running PraisonAI processes and verify CALL_SERVER_TOKEN is defined in the environment before the call server starts.
Inspect HTTP access logs for requests to agent control paths that lack an Authorization header or bearer token.
Correlate agent lifecycle events (register, unregister, invoke) with authenticated identity data to surface unauthenticated activity.

Monitoring Recommendations

Alert on any inbound network connection to PraisonAI call server ports from outside expected management subnets.
Track version telemetry across the fleet and flag PraisonAI instances running below 4.6.40.
Log and review agent metadata read operations, since they expose instructions that may contain sensitive prompts.

How to Mitigate CVE-2026-47396

Immediate Actions Required

Upgrade PraisonAI to version 4.6.40 or later on all systems running the call server.
Set a strong, random CALL_SERVER_TOKEN value for every deployment before starting the call server.
Restrict network exposure of the call server to trusted management networks using firewall rules or reverse proxy access controls.
Rotate any agent instructions or secrets that may have been exposed while the server ran without authentication.

Patch Information

The vendor fix is included in PraisonAI 4.6.40. The remediation is tracked in the GitHub commit ef79b7a and documented in the GitHub Security Advisory GHSA-86qc-r5v2-v6x6.

Workarounds

If upgrading immediately is not possible, always export CALL_SERVER_TOKEN with a strong secret before launching the call server.
Bind the call server to 127.0.0.1 instead of 0.0.0.0 and front it with an authenticating reverse proxy.
Place network access control lists in front of the call server so only known clients can reach the agent control API.

bash

# Configuration example: enforce token and restrict binding
export CALL_SERVER_TOKEN="$(openssl rand -hex 32)"
export CALL_SERVER_HOST="127.0.0.1"

# Verify PraisonAI version is patched
pip install --upgrade "praisonai>=4.6.40"
pip show praisonai | grep -i version