praisonai: Improper Access Control (CVE-2026-47396)

Weakness-Klassen (CWE)

• CWE-284Pillar

  Improper Access Control

  The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

  cwe.mitre.org →

• CWE-306Base

  Missing Authentication for Critical Function

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

  cwe.mitre.org →

Re-Analyse & Statuswechsel

Chronologie der NVD-Audit-Events für diese CVE — Reanalyses, CVSS-Updates, CPE-Diffs.

1. CVE Modified2026-07-22 15:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
   • Reference: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-86qc-r5v2-v6x6
   • SSVC: {"id":"CVE-2026-47396","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalI…
2. New CVE Received2026-07-21 16:17 UTC· security-advisories@github.com
   • Affected: PraisonAI
   • Description: PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.
   • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
   • CWE: CWE-284

Betroffene Produkte

Aus der Hersteller-/CERT-Meldung extrahierte Produkte und Versionsbereiche. Ein Version-Range wie „<4.14.6“ impliziert die Update-Empfehlung „auf 4.14.6 oder höher aktualisieren“.

• pypi

  praisonai0.0.1

• pypi

  praisonai0.0.10

• pypi

  praisonai0.0.11

• pypi

  praisonai0.0.12

• pypi

  praisonai0.0.13

• pypi

  praisonai0.0.14

• pypi

  praisonai0.0.15

• pypi

  praisonai0.0.16

• pypi

  praisonai0.0.17

• pypi

  praisonai0.0.18

• pypi

  praisonai0.0.19

• pypi

  praisonai0.0.2

• pypi

  praisonai0.0.20

• pypi

  praisonai0.0.21

• pypi

  praisonai0.0.22

• pypi

  praisonai0.0.23

• pypi

  praisonai0.0.24

• pypi

  praisonai0.0.25

• pypi

  praisonai0.0.26

• pypi

  praisonai0.0.27

• pypi

  praisonai0.0.28

• pypi

  praisonai0.0.29

• pypi

  praisonai0.0.3

• pypi

  praisonai0.0.30

Quellen & Referenzen

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-86qc-r5v2-v6x6
  web
• https://github.com/MervinPraison/PraisonAI
  package
• https://pypi.org/project/praisonai
  package
• https://github.com/advisories/GHSA-86qc-r5v2-v6x6
  advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47396
  advisory
• https://github.com/MervinPraison/PraisonAI/commit/ef79b7a0561796ad9807f0f09538c25cc78d3619
  x_refsource_MISC

Verknüpfte Empfehlungen

• sans-atrisk-mail2026-07-30 00:00 UTC
  @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 29