PatchSiren cyber security CVE debrief
CVE-2026-47396 MervinPraison CVE debrief
CVE-2026-47396 is a critical vulnerability in PraisonAI's call server, affecting the `praisonai.api.agent_invoke` component. The vulnerability allows unauthorized access to sensitive agent-control endpoints when `CALL_SERVER_TOKEN` is not configured. This issue is particularly concerning as the bundled call server binds to `0.0.0.0`, making it accessible to any client on the network. The vulnerability has a CVSS score of 9.8 and is classified as CRITICAL. Operators who launch the PraisonAI call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane.
- Vendor
- MervinPraison
- Product
- PraisonAI
- CVSS
- CRITICAL 9.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Operators who launch the PraisonAI call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Users of PraisonAI versions prior to 4.6.40 should take immediate action to secure their deployments. This includes reviewing and updating their current configuration, restricting access to the call server, and implementing additional security measures.
Technical summary
The `praisonai.api.agent_invoke` router, as mounted by `praisonai.api.call`, lacks authentication when `CALL_SERVER_TOKEN` is unset. The authentication helper `verify_token()` fails open, allowing unauthorized access to sensitive agent-control endpoints. This is particularly concerning as the bundled call server binds to `0.0.0.0`, making it accessible to any client on the network. Operators should be aware that the call server's default configuration may expose it to unauthorized access, potentially allowing attackers to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents.
Defensive priority
High
Recommended defensive actions
- Immediately set `CALL_SERVER_TOKEN` to a secure value
- Upgrade to PraisonAI version 4.6.40 or later
- Restrict access to the call server to only trusted clients
- Monitor for suspicious activity on the call server
- Implement additional security measures, such as network segmentation and access controls
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-21T16:17:12.760Z and has been modified since then. The NVD entry is currently Deferred. The vulnerability has a CVSS score of 9.8 and is classified as CRITICAL. There is limited information available about the affected product deployments and potential exposure. Further verification is needed to determine the extent of the vulnerability.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T16:17:12.760Z and has been modified since then. The NVD entry is currently Deferred.