CVE-2026-47396
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
PraisonAI prior to version 4.6.40 exposes an unauthenticated agent control API when CALL_SERVER_TOKEN is not set. The verify_token() helper fails open, and the call server binds to 0.0.0.0 by default, allowing any client to list, inspect, invoke, and unregister agents.
Risk Assessment
Operators may unintentionally expose an unauthenticated remote agent control plane, enabling attackers to take over agents and potentially the entire system.
Recommendation
Upgrade PraisonAI to version 4.6.40 and always set a strong CALL_SERVER_TOKEN before starting the call server.
Original NVD description (English source)
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.