Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

PraisonAI before version 4.6.40 includes a call server that, if the configuration variable CALL_SERVER_TOKEN is not set, exposes a network‑facing agent control API without authentication. The token verification helper fails open, so any client that can reach the server on 0.0.0.0 can list agents, view their metadata and instructions, invoke them, and unregister them. This permits unauthenticated remote manipulation of agents, potentially allowing arbitrary code to be run within the agent environment. The vulnerability is classified under CWE‑284 (Improper Access Control) and CWE‑306 (Missing Authentication).

Affected Systems

PraisonAI from MervinPraison, all releases prior to version 4.6.40, are vulnerable. Starting the call server without setting CALL_SERVER_TOKEN exposes the router over 0.0.0.0, making it reachable on all network interfaces.

Risk and Exploitability

The flaw receives a CVSS score of 9.8, indicating a high‑severity impact when the token is unset. The EPSS score is below 1%, meaning that current exploitation activity is low, but the vulnerability is not listed in CISA KEV. Attackers who can reach the call server can issue HTTP requests to the exposed endpoints and perform any agent operation without credentials. The CVE highlights that such operations can lead to remote control of the agent, and it is inferred that this can enable remote code execution; however, the advisory does not explicitly confirm the execution of arbitrary code.

Generated by OpenCVE AI on July 30, 2026 at 17:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Set the environment variable CALL_SERVER_TOKEN to a strong secret before starting the PraisonAI call server. This prevents the authentication helper from falling back to open access.
  • Upgrade PraisonAI to version 4.6.40 or newer, which contains a fix that enforces token verification for all agent‑control endpoints.
  • If an upgrade is not immediately possible, limit the call server’s exposure by configuring firewall rules or network segmentation so that only trusted hosts can reach the 0.0.0.0 interface.

Generated by OpenCVE AI on July 30, 2026 at 17:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-86qc-r5v2-v6x6 PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
History

Wed, 22 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Mervinpraison
Mervinpraison praisonai
Vendors & Products Mervinpraison
Mervinpraison praisonai

Tue, 21 Jul 2026 16:00:00 +0000

Type Values Removed Values Added
Description PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.
Title PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Weaknesses CWE-284
CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Mervinpraison Praisonai
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-22T14:13:42.099Z

Reserved: 2026-05-19T19:22:45.729Z

Link: CVE-2026-47396

cve-icon Vulnrichment

Updated: 2026-07-22T14:13:31.978Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T17:15:12Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function