CVE-2026-47396 MervinPraison CVE debrief

Who should care

Operators who launch the PraisonAI call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Users of PraisonAI versions prior to 4.6.40 should take immediate action to secure their deployments. This includes reviewing and updating their current configuration, restricting access to the call server, and implementing additional security measures.

Technical summary

The `praisonai.api.agent_invoke` router, as mounted by `praisonai.api.call`, lacks authentication when `CALL_SERVER_TOKEN` is unset. The authentication helper `verify_token()` fails open, allowing unauthorized access to sensitive agent-control endpoints. This is particularly concerning as the bundled call server binds to `0.0.0.0`, making it accessible to any client on the network. Operators should be aware that the call server's default configuration may expose it to unauthorized access, potentially allowing attackers to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents.

Defensive priority

High

Recommended defensive actions

• Immediately set `CALL_SERVER_TOKEN` to a secure value
• Upgrade to PraisonAI version 4.6.40 or later
• Restrict access to the call server to only trusted clients
• Monitor for suspicious activity on the call server
• Implement additional security measures, such as network segmentation and access controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-21T16:17:12.760Z and has been modified since then. The NVD entry is currently Deferred. The vulnerability has a CVSS score of 9.8 and is classified as CRITICAL. There is limited information available about the affected product deployments and potential exposure. Further verification is needed to determine the extent of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.