CVE-2026-47396 in PraisonAI
Summary
by MITRE • 07/21/2026
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The PraisonAI multi-agent system presents a critical authentication vulnerability in versions prior to 4.6.40 that exposes sensitive agent control functionality to unauthorized network access. This vulnerability stems from the call server's improper handling of authentication tokens when the CALL_SERVER_TOKEN environment variable remains unset. The affected component resides within the praisonai.api.agent_invoke router, which serves as the primary interface for agent control operations and is mounted through the praisonai.api.call module. The authentication mechanism fails open by design when no token is configured, creating a dangerous security gap that allows any network client with access to the server to exploit multiple sensitive endpoints.
The technical flaw manifests in the verify_token() authentication helper function which operates on a fail-open principle rather than a fail-closed approach when the CALL_SERVER_TOKEN environment variable is not defined. This design decision creates an inherent security weakness where the absence of explicit token configuration results in complete access permission rather than denying access. All sensitive agent-control endpoints rely on this single verification mechanism, making it a critical single point of failure. The vulnerability becomes particularly dangerous when operators launch the call server without explicitly setting the CALL_SERVER_TOKEN environment variable, as the server automatically binds to 0.0.0.0, making it accessible from any network interface.
The operational impact of this vulnerability extends far beyond simple unauthorized access, encompassing complete control over the agent management system. An attacker with network reachability can enumerate available agents through listing operations, inspect detailed agent metadata and instructions that may contain sensitive configuration information, invoke agents to perform arbitrary operations, and unregister agents to disrupt system functionality. This comprehensive access allows for potential data exfiltration, system disruption, and escalation of privileges within the multi-agent environment. The vulnerability represents a direct violation of the principle of least privilege and creates opportunities for attackers to manipulate agent behavior for malicious purposes.
This security weakness aligns with CWE-305 authentication bypass vulnerabilities and maps to ATT&CK technique T1566.001 for credential access through unsecured network services. The configuration error falls under the category of insecure default settings, where the system assumes a secure state when no explicit security measures are implemented. The vulnerability also demonstrates poor secure coding practices related to authentication handling and environment variable validation. Organizations deploying PraisonAI without proper token configuration face significant risk of unauthorized access to their agent control plane, potentially exposing sensitive business processes and automated workflows that rely on the multi-agent system for operation.
The issue was successfully addressed in version 4.6.40 through proper implementation of token validation that enforces authentication requirements even when environment variables are unset. This fix ensures that the verify_token() function operates in a fail-closed manner rather than a fail-open approach, requiring explicit authentication tokens for all agent control operations. The updated version implements proper validation and error handling to prevent unauthorized access while maintaining system functionality for legitimate users who properly configure the CALL_SERVER_TOKEN environment variable. Security operators should immediately upgrade to version 4.6.40 or later and review existing deployments to ensure that appropriate token configurations are in place.