PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47393 MervinPraison CVE debrief

CVE-2026-47393 is a critical vulnerability in PraisonAI, a multi-agent teams system. The issue arises from a code-generator that creates a Flask API server with authentication disabled by default. This affects users who follow the quickstart guide and deploy the API server binding to 0.0.0.0, exposing endpoints like /chat and /agents. The server runs praisonai.run() on user-supplied JSON input, which includes LLM orchestration with API key materials in the process environment, without requiring authentication. This vulnerability is particularly severe as it allows for unauthenticated access to sensitive functionality.

Vendor
MervinPraison
Product
PraisonAI
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Users of PraisonAI, especially those who have followed the quickstart guide and deployed the API server, should be concerned about this vulnerability. The lack of authentication by default in the generated API server poses a significant risk, as it could allow attackers to interact with the /chat and /agents endpoints without proper authorization. This could lead to unauthorized access, data manipulation, or other malicious activities.

Technical summary

The PraisonAI system, through its code-generator (praisonai.deploy.api.generate_api_server_code), creates a Flask API server that does not have authentication enabled by default. When users follow the quickstart guide (praisonai deploy --type api), the generated server binds to 0.0.0.0, making it accessible from any network interface. The server exposes endpoints such as /chat and /agents and processes user-supplied JSON input via praisonai.run(), which includes API key materials in the process environment. This setup does not require any authentication, making it vulnerable to unauthorized access and potential exploitation.

Defensive priority

High

Recommended defensive actions

  • Immediately update to version 4.6.40 or later of PraisonAI to ensure the authentication bypass is fixed.
  • Review and modify any existing deployments to ensure authentication is enabled.
  • Implement additional monitoring and security measures to detect and prevent unauthorized access.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail provide information about the vulnerability, including its critical severity score of 9.8. The source references include links to GitHub commits, pull requests, and security advisories related to the fix and disclosure of the vulnerability.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T16:17:12.270Z and has not been modified since then.