CVE-2026-47393 Details
Description
PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that binds to `0.0.0.0` per the recommended sample YAML, exposes `/chat` and `/agents` endpoints, runs `praisonai.run()` on user-supplied JSON input — LLM orchestration with the API key materials present in the process environment, and does not require any authentication. Versions prior to 4.6.40 still ship the generator with `auth_enabled` defaulting to `False`. The fix shape is opt-in via `APIConfig(auth_enabled=True, auth_token=...)`. Version 4.6.40 fixes the issue.
A vulnerability exists in PraisonAI versions through 4.6.33, where the code generator for the Flask API server disables authentication by default. This issue allows unauthenticated access to the '/chat' and '/agents' endpoints, enabling unauthorized users to execute workflows and access agent metadata. The vulnerability arises because the server binds to '0.0.0.0' and runs 'praisonai.run()' with the user's LLM API keys in the environment, without any authentication checks. The issue can be reproduced by deploying a server with the default configuration, which lacks authentication, and then accessing the exposed endpoints.
Users can update to PraisonAI version 4.6.40 or later, where this vulnerability is fixed. After updating, the authentication feature is enabled by default.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8444-4fhq-fxpq | CISA-ADP | AdvisoryBundleExploitRemedyVendor |
| https://github.com/advisories/GHSA-6rmh-7xcm-cpxj | [email protected] | AdvisoryRemedyVendor |
| https://github.com/MervinPraison/PraisonAI/commit/ef79b7a0561796ad9807f0f09538c25cc78d3619 | [email protected] | Source CodeVendor |
| https://github.com/MervinPraison/PraisonAI/pull/1685 | [email protected] | Issue TrackingVendor |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8444-4fhq-fxpq | [email protected] | AdvisoryBundleExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PraisonAI | >= 2.5.6, <= 4.6.33 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |