CVE-2026-47393
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
PraisonAI by default generates a Flask API server without authentication, listening on all network interfaces (0.0.0.0) and exposing sensitive endpoints. An attacker can send requests to /chat and /agents endpoints without any authentication, allowing execution of LLM code with API keys present in the environment.
Risk Assessment
The organization is exposed to unauthorized access to LLM functions and potential theft of API keys, which could lead to data leakage or uncontrolled resource usage.
Recommendation
Update PraisonAI to version 4.6.40 and enable authentication via APIConfig(auth_enabled=True, auth_token=...).
Original NVD description (English source)
PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that binds to `0.0.0.0` per the recommended sample YAML, exposes `/chat` and `/agents` endpoints, runs `praisonai.run()` on user-supplied JSON input — LLM orchestration with the API key materials present in the process environment, and does not require any authentication. Versions prior to 4.6.40 still ship the generator with `auth_enabled` defaulting to `False`. The fix shape is opt-in via `APIConfig(auth_enabled=True, auth_token=...)`. Version 4.6.40 fixes the issue.