CVE-2026-47396: 
PraisonAI vulnerability analysis and mitigation

CVE-2026-47396 is a missing authentication vulnerability in PraisonAI's call server that exposes a network-facing agent control API without any authentication when the CALL_SERVER_TOKEN environment variable is not configured. It affects PraisonAI (pip package) versions up to and including 4.6.39, with version 4.6.40 containing the fix. The vulnerability was published by MervinPraison on May 19, 2026, and added to the GitHub Advisory Database on May 29, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, PraisonAI Advisory).

The root cause is a fail-open authentication design flaw (CWE-284: Improper Access Control; CWE-306: Missing Authentication for Critical Function) in praisonai/api/agent_invoke.py. The verify_token() dependency function returns immediately without enforcing any authentication check when CALL_SERVER_TOKEN is absent from the environment: if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN: return. All sensitive agent-control endpoints — GET /api/v1/agents, GET /api/v1/agents/{agent_id}, POST /api/v1/agents/{agent_id}/invoke, and DELETE /api/v1/agents/{agent_id} — depend on this helper via FastAPI's Depends(verify_token). The vulnerable router is mounted by praisonai.api.call, which binds the server to 0.0.0.0, making the unauthenticated API reachable from any network-accessible client when the token is not set. A public PoC is included in the advisory demonstrating successful unauthenticated access to all four endpoints (GitHub Advisory).

Any network-reachable client can enumerate registered agents, read agent metadata and instruction text, invoke agents (triggering execution of connected tools and external integrations), and unregister agents — all without authentication. For deployments where agents are wired to external APIs, internal systems, local tools, or privileged actions, this creates a fully unauthenticated remote control plane. Beyond information disclosure, attackers can abuse the invoke endpoint to exhaust model or API budgets through repeated calls, and the delete endpoint to disrupt availability by removing registered agents (GitHub Advisory, PraisonAI Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible PraisonAI call server instances (running praisonai-call) using tools like Shodan or Censys, or by scanning for the default server port. Confirm the target is running PraisonAI pip package version ≤ 4.6.39.
2. Verify unauthenticated access: Send a GET /api/v1/agents request to the target without any Authorization header. A 200 OK response with a JSON body listing agents confirms the server is running without CALL_SERVER_TOKEN configured.
3. Enumerate agent metadata: For each agent ID returned, send GET /api/v1/agents/{agent_id} to retrieve agent metadata, instruction text, and connected tool names — potentially revealing sensitive operational details.
4. Invoke agents: Send POST /api/v1/agents/{agent_id}/invoke with a JSON body such as {"message": "<payload>"} to trigger agent execution, which may interact with downstream APIs, internal systems, or local tools connected to the agent.
5. Disrupt availability (optional): Send DELETE /api/v1/agents/{agent_id} to unregister agents, disrupting the availability of the agent control plane. (GitHub Advisory)

• Network: Unexpected HTTP GET requests to /api/v1/agents or /api/v1/agents/{agent_id} from external or untrusted IP addresses without an Authorization header; unexpected POST requests to /api/v1/agents/{agent_id}/invoke or DELETE requests to /api/v1/agents/{agent_id} from unauthenticated clients.
• Logs: Web server access logs showing 200 OK responses to agent-control endpoints from unknown or external clients; absence of Authorization headers in requests to sensitive routes; repeated invocation requests indicating automated abuse or budget exhaustion attempts.
• Process/Application: Unexpected agent executions or downstream API calls triggered outside of normal operational patterns; agents disappearing from the registry (indicating unauthenticated deletion); unusual consumption of model API quota or budget. (GitHub Advisory)

Upgrade PraisonAI to version 4.6.40 or later, which contains the fix for this vulnerability. As an immediate workaround for operators unable to upgrade, explicitly set the CALL_SERVER_TOKEN environment variable to a strong, randomly generated secret before starting the call server — this enables authentication enforcement. Additionally, restrict network access to the call server port using firewall rules or network segmentation to limit exposure to trusted clients only. If the call server is only needed for local development, binding it to 127.0.0.1 instead of 0.0.0.0 prevents remote access (GitHub Advisory, PraisonAI Advisory).