CVE-2026-47393 Google Chronicle · YARA-L

Detect PraisonAI Flask API Server Deployed Without Authentication (CVE-2026-47393) in Google Chronicle

PraisonAI versions <= 4.6.39, when deployed via `deploy --type api`, expose a Flask HTTP server with authentication disabled by default (CWE-306, CWE-1188). Any unauthenticated actor with network access can invoke the AI agent API, exfiltrate model outputs, or use the endpoint as a proxy for downstream attacks. CVSS 9.8 critical; public PoC available.

MITRE ATT&CK

Tactic
Initial Access Defense Evasion Exfiltration

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule praisonai_unauthenticated_api_deploy {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects PraisonAI deploy --type api invocation or external inbound to Flask ports"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8444-4fhq-fxpq"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.principal.process.command_line, `(?i)praisonai.*deploy.*api`)
    ) or (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      and $e.target.port in (5000, 8000, 8080, 8888)
      and not net.ip_in_range_cidr($e.principal.ip, "10.0.0.0/8")
      and not net.ip_in_range_cidr($e.principal.ip, "172.16.0.0/12")
      and not net.ip_in_range_cidr($e.principal.ip, "192.168.0.0/16")
    )

  condition:
    $e
}
critical severity medium confidence

Chronicle YARA-L rule triggering on PraisonAI deploy command lines or external network connections to common Flask API ports.

Data Sources

Chronicle UDM Endpoint TelemetryChronicle UDM Network Telemetry

Required Tables

UDM Events

False Positives & Tuning

  • Other Python applications using Flask on the same default ports
  • Authorized remote access via VPN that resolves to an external IP in logs
  • Container overlay networks presenting non-RFC1918 addresses internally

Other platforms for CVE-2026-47393

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Deploy PraisonAI API without authentication and verify unauthenticated access

    Expected signal: Process creation event for python/praisonai with command line containing 'deploy --type api'; network socket bound to 0.0.0.0:5000; HTTP 200 response with no Authorization header in request

  2. Test 2Enumerate PraisonAI API endpoints unauthenticated from a remote host

    Expected signal: Inbound NetworkConnectIP4/NetworkConnectionEvents on port 5000 from a non-RFC1918 IP; HTTP GET and POST requests in web/proxy logs with no authentication headers

  3. Test 3Verify PraisonAI package version on a Linux host using pip

    Expected signal: Process creation for pip/python3 with 'praisonai' argument in command line; stdout output containing version string <= 4.6.39

  4. Test 4Simulate attacker submitting agent task via unauthenticated PraisonAI API

    Expected signal: HTTP POST to /api endpoint with no Authorization or Cookie headers; PraisonAI process spawning child processes to execute agent task; outbound connections if agent task triggers tool use

Last updated: 2026-06-23 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify all hosts where PraisonAI is installed by querying package inventory or running `pip show praisonai` across managed endpoints; flag any version <= 4.6.39.
  2. Determine whether `deploy --type api` was invoked by reviewing process creation logs, cron jobs, systemd units, or container entrypoints for the PraisonAI API command.
  3. Check whether the Flask port (default 5000 or configured alternative) is reachable from untrusted network segments by reviewing firewall rules, security group configurations, and load balancer listeners.
  4. Inspect Flask access logs (if available at the application level) or network flow logs for any unauthenticated HTTP requests hitting PraisonAI API endpoints, noting source IPs and request bodies.

Containment

  1. Immediately apply host-based or network firewall rules to block inbound traffic to the PraisonAI Flask port from any source outside explicitly trusted subnets until authentication is enforced or the service is terminated.
  2. If the service is not business-critical at this moment, stop the PraisonAI API process (`pkill -f 'praisonai'` or equivalent) and disable the service unit or cron entry to prevent restart until patched.

Evidence Collection

  1. Capture a full process snapshot (ps aux / tasklist) and network socket state (ss -tlnp / netstat -ano) from the affected host at time of containment, preserving evidence of the listening service.
  2. Export Flask/web server access logs and any available API request/response bodies to determine whether data was accessed or commands were executed by unauthenticated callers.

Escalation Criteria

  • !Escalate to Incident Response if access logs show any external IP successfully calling API endpoints, or if PraisonAI was configured with access to internal systems, databases, or credentials.
  • !Escalate if the affected host is internet-facing, part of a production AI pipeline, or stores sensitive data processed by the PraisonAI agent workflows.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Python process command line containing 'praisonai' and 'deploy' and 'api' in process creation logs
  • >Network socket bound to port 5000/8000/8080/8888 with a Python process owner in /proc/net/tcp or equivalent
  • >Flask access log entries (if configured) at the PraisonAI working directory showing HTTP 200 responses to unauthenticated callers
  • >pip package metadata confirming praisonai version <= 4.6.39 at /path/to/site-packages/praisonai-*.dist-info/METADATA

Tuning Guidance

Reduce false positives by scoping the process-based detection to hosts where PraisonAI is a known installed package (cross-reference asset inventory). Exclude RFC1918 source IPs from the network-based rules if the deployment is internal-only. If a reverse proxy (nginx, Caddy) sits in front of the Flask server and enforces authentication, adjust rules to alert only when the Flask port is directly exposed without a proxy process also listening on 443/80 on the same host.

Hunting Queries

Hunt for all PraisonAI installs at or below the vulnerable version across managed endpoints using Defender for Endpoint software inventory.

Hunting — KQL
kql 
DeviceTvmSoftwareInventory
| where SoftwareName =~ "praisonai"
| where SoftwareVersion <= "4.6.39"
| project DeviceName, SoftwareVersion, OSPlatform, LastSeenTime
| order by LastSeenTime desc
Hunting — SPL
spl 
index=* sourcetype=software_inventory product_name=praisonai
| where version <= "4.6.39"
| table host, version, last_seen
| sort -last_seen

Hunt for any HTTP requests made to the PraisonAI Flask API from non-private IP addresses in proxy or web gateway logs.

Hunting — KQL
kql 
W3CIISLog
| where csUriStem has_any ("/api", "/v1", "/run", "/chat")
| where ipv4_is_private(cIP) == false
| project TimeGenerated, cIP, csMethod, csUriStem, scStatus, csUserName
| where csUserName == "-" or isempty(csUserName)
| order by TimeGenerated desc
Hunting — SPL
spl 
index=proxy OR index=web_logs
| where uri_path IN ("/api", "/v1", "/run", "/chat")
  AND NOT match(src_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)")
  AND (user="-" OR isnull(user))
| table _time, src_ip, method, uri_path, status, user
| sort -_time

Atomic Red Team Tests

Test 1 Deploy PraisonAI API without authentication and verify unauthenticated access
linux

Install PraisonAI <= 4.6.39 in an isolated lab VM, deploy the Flask API server, and confirm that a curl request with no credentials returns a successful response, demonstrating the missing authentication default.

Command

bash 
pip install 'praisonai==4.6.39' && praisonai deploy --type api &
sleep 5
curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/

Cleanup

bash 
pkill -f 'praisonai' || true; pip uninstall -y praisonai || true

Expected Telemetry

Process creation event for python/praisonai with command line containing 'deploy --type api'; network socket bound to 0.0.0.0:5000; HTTP 200 response with no Authorization header in request

Expected Detection

KQL/SPL process-based rule fires on command line match; network rule fires if curl originates from non-RFC1918 address or if host is scanned externally

Test 2 Enumerate PraisonAI API endpoints unauthenticated from a remote host
linux

From a separate host simulating an external attacker, scan the PraisonAI Flask port to enumerate available API routes without any credentials, confirming the attack surface.

Command

bash 
TARGET_IP=<lab-praisonai-host-ip>
curl -s http://${TARGET_IP}:5000/ | python3 -m json.tool
curl -s -X POST http://${TARGET_IP}:5000/api -H 'Content-Type: application/json' -d '{"prompt": "test"}'

Cleanup

bash 
No cleanup required on attacker host; ensure lab network is isolated

Expected Telemetry

Inbound NetworkConnectIP4/NetworkConnectionEvents on port 5000 from a non-RFC1918 IP; HTTP GET and POST requests in web/proxy logs with no authentication headers

Expected Detection

Network-based detection rules trigger on external IP connecting to Flask port; SIEM alert generated linking to CVE-2026-47393

Test 3 Verify PraisonAI package version on a Linux host using pip
linux

Simulate a vulnerability scanner or asset inventory check by running pip show to reveal the installed PraisonAI version, confirming whether the host is running a vulnerable release.

Command

bash 
pip show praisonai 2>/dev/null | grep -E 'Name|Version|Location'
python3 -c "import importlib.metadata; print(importlib.metadata.version('praisonai'))"

Cleanup

bash 
No cleanup required — read-only operation

Expected Telemetry

Process creation for pip/python3 with 'praisonai' argument in command line; stdout output containing version string <= 4.6.39

Expected Detection

Software inventory queries surface the vulnerable version; asset management tooling should flag the package for immediate patching or removal

Test 4 Simulate attacker submitting agent task via unauthenticated PraisonAI API
linux

From an attacker-controlled machine, POST a crafted agent task payload to the unprotected PraisonAI Flask endpoint to demonstrate full unauthenticated code-path execution.

Command

bash 
TARGET_IP=<lab-praisonai-host-ip>
curl -s -X POST http://${TARGET_IP}:5000/api \
  -H 'Content-Type: application/json' \
  -d '{"agents": [{"name": "test", "role": "tester", "goal": "echo hello", "tasks": [{"description": "echo hello world"}]}]}' \
  | python3 -m json.tool

Cleanup

bash 
Terminate PraisonAI process on lab host; reset lab environment

Expected Telemetry

HTTP POST to /api endpoint with no Authorization or Cookie headers; PraisonAI process spawning child processes to execute agent task; outbound connections if agent task triggers tool use

Expected Detection

Full detection chain fires: process launch rule + network connection rule + (if proxy logging enabled) HTTP POST without auth to PraisonAI route

Related Detections

Tactic Hubs

TA0001Initial AccessTA0005Defense EvasionTA0010Exfiltration

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1059.006Python

Same Tactic: Initial Access

Popular Detections