CVE-2026-47391 MervinPraison CVE debrief

Who should care

Defenders of PraisonAI deployments, particularly those using the official A2A example or similar unauthenticated public A2A deployments with unsafe tools, should assess their exposure and take immediate action to mitigate the vulnerability.

Why it matters

CVE-2026-47391 is a critical vulnerability in PraisonAI's multi-agent teams system that allows for arbitrary Python execution in the server process. Defenders of PraisonAI deployments should assess their exposure and take immediate action to mitigate the vulnerability.

• Arbitrary Python execution in the server process
• Potential for confidentiality and integrity impact due to exposure of task history and task cancellation APIs
• Need for verification of affected versions and remediation status
• Potential for lateral movement and escalation of privileges

Technical summary

The vulnerability is caused by the exposure of an unauthenticated A2A JSON-RPC endpoint and the registration of a `calculate(expression)` tool implemented with Python `eval()`. This allows for arbitrary Python execution in the server process. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools, potentially leading to confidentiality and integrity impacts. Defenders of PraisonAI deployments should assess their exposure and take immediate action to mitigate the vulnerability.

Defensive priority

High

Recommended defensive actions

• Immediately update PraisonAI to version 4.6.40 or later
• Disable the unauthenticated A2A JSON-RPC endpoint
• Restrict access to the A2A server example
• Implement authentication and authorization for A2A deployments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.