Security readout for executives and security teams
Plain-English summary
PraisonAI call servers started without CALL_SERVER_TOKEN may expose an unauthenticated remote control plane. A reachable attacker could see agent details, trigger agents, or remove registered agents. The issue is fixed in version 4.6.40.
Executive priority
Treat this as urgent for any exposed PraisonAI call server. Prioritize upgrade and token enforcement because the flaw affects confidentiality, integrity, and availability of agent operations.
Technical view
Before 4.6.40, praisonai.api.call mounts the agent_invoke router, whose sensitive endpoints depend on verify_token(). That helper fails open when CALL_SERVER_TOKEN is unset. Because the bundled call server binds to 0.0.0.0, reachable clients can access agent listing, metadata inspection, invocation, and unregistration without authentication.
Likely exposure
Highest risk is PraisonAI versions earlier than 4.6.40 running the call server without CALL_SERVER_TOKEN, especially if reachable from untrusted networks or the internet.
Exploitation context
The bundle does not cite active exploitation, and KEV is false. Risk is still high because exploitation requires network reachability and no credentials when the token is unset.
Researcher notes
The root issue is fail-open authentication in verify_token() when CALL_SERVER_TOKEN is unset. The vulnerable router is agent_invoke as mounted by praisonai.api.call. Sources identify CWE-284 and CWE-306 with CVSS 3.1 score 9.8.
Mitigation direction
- Upgrade PraisonAI to version 4.6.40 or later.
- Set CALL_SERVER_TOKEN for any call server deployment.
- Restrict call server network exposure to trusted hosts or private networks.
- Disable the call server where it is not operationally required.
- Review vendor guidance for any additional hardening steps.
Validation and detection
- Inventory PraisonAI deployments and identify versions earlier than 4.6.40.
- Confirm whether the call server is running in each deployment.
- Verify CALL_SERVER_TOKEN is explicitly configured where the call server is used.
- Check whether the service is reachable from untrusted networks.
- Review logs for unexpected agent listing, invocation, or unregistration activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-47396 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-86qc-r5v2-v6x6CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/MervinPraison/PraisonAI/commit/ef79b7a0561796ad9807f0f09538c25cc78d3619CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.