PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47393 MervinPraison CVE debrief

CVE-2026-47393 is a critical vulnerability in PraisonAI, a multi-agent teams system. The issue arises from a code-generator that creates a Flask API server with authentication disabled by default. This affects users who follow the quickstart guide and deploy the API server binding to 0.0.0.0, exposing endpoints like /chat and /agents. The server runs praisonai.run() on user-supplied JSON input, which includes LLM orchestration with API key materials in the process environment, without requiring authentication. This vulnerability is particularly severe as it allows for unauthenticated access to sensitive functionality.

Vendor
MervinPraison
Product
PraisonAI
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Users of PraisonAI, especially those who have followed the quickstart guide and deployed the API server, should be concerned about this vulnerability. The lack of authentication by default in the generated API server poses a significant risk, as it could allow attackers to interact with the /chat and /agents endpoints without proper authorization. This could lead to unauthorized access, data manipulation, or other malicious activities.

Technical summary

The PraisonAI system, through its code-generator (praisonai.deploy.api.generate_api_server_code), creates a Flask API server that does not have authentication enabled by default. When users follow the quickstart guide (praisonai deploy --type api), the generated server binds to 0.0.0.0, making it accessible from any network interface. The server exposes endpoints such as /chat and /agents and processes user-supplied JSON input via praisonai.run(), which includes API key materials in the process environment. This setup does not require any authentication, making it vulnerable to unauthorized access and potential exploitation.

Defensive priority

High

Recommended defensive actions

  • Immediately update to version 4.6.40 or later of PraisonAI to ensure the authentication bypass is fixed.
  • Review and modify any existing deployments to ensure authentication is enabled.
  • Implement additional monitoring and security measures to detect and prevent unauthorized access.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail provide information about the vulnerability, including its critical severity score of 9.8. The source references include links to GitHub commits, pull requests, and security advisories related to the fix and disclosure of the vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47393 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47393

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47393 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47393

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.