CVE-2026-47396 PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Unauthenticated remote attackers can list, invoke, and delete agents if the call server is started without a configured token.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47396?
CVE-2026-47396 is a critical missing authorization vulnerability in MervinPraison PraisonAI, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.
Which versions are affected by CVE-2026-47396?
3 open source packages ship an affected version, including praisonai and PraisonAI.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | All versions | 4.6.40 |
praisonai PyPI | All versions | 4.6.40 |
PraisonAI PyPI | All versions | 4.6.40 |
How do I fix CVE-2026-47396?
Upgrade praisonai to 4.6.40 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47396 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47396 exists.
Sources
Also known as GHSA-86qc-r5v2-v6x6, PYSEC-2026-466.