CVE-2026-47396 Splunk · SPL

Detect PraisonAI Call Server Unauthenticated Agent Access (CVE-2026-47396) in Splunk

Detects exploitation of CVE-2026-47396, a critical authentication bypass in PraisonAI's call server component. When the CALL_SERVER_TOKEN environment variable is unset, the server exposes unauthenticated endpoints for listing, invoking, and deleting AI agents. An attacker can enumerate available agents, invoke arbitrary agent workflows, or destroy agent configurations without any credentials. CVSS 9.8 (Critical), CWE-284/CWE-306.

MITRE ATT&CK

Tactic
Initial Access Persistence Impact

SPL Detection Query

Splunk (SPL)
spl 
index=web OR index=proxy sourcetype IN ("access_combined", "iis", "nginx:access", "apache:access")
| where (uri_path="/agents*" OR uri_path="/invoke*" OR uri_path="/delete*")
| eval has_auth=if(like(lower(http_request_header), "%authorization: bearer%"), "yes", "no")
| where has_auth="no"
| eval http_method=coalesce(http_method, method)
| stats count AS request_count, values(http_method) AS methods, values(status) AS status_codes, dc(uri_path) AS unique_endpoints BY src_ip, span("5m") _time
| where request_count > 2
| eval risk_score=case(request_count > 20, "critical", request_count > 10, "high", request_count > 5, "medium", true(), "low")
| table _time, src_ip, request_count, methods, status_codes, unique_endpoints, risk_score
| sort - request_count
critical severity medium confidence

Detects unauthenticated requests to PraisonAI call server agent endpoints in web/proxy logs, flagging sources lacking an Authorization Bearer header and aggregating by source IP.

Data Sources

Web proxy logsNginx access logsApache access logsIIS logs

Required Sourcetypes

access_combinediisnginx:accessapache:access

False Positives & Tuning

  • Internal monitoring tools polling the agents endpoint for availability checks
  • Development environments with authentication deliberately disabled
  • CI/CD pipeline tests querying agent endpoints without credentials
  • Misconfigured reverse proxies stripping Authorization headers before logging

Other platforms for CVE-2026-47396

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Enumerate PraisonAI agents without authentication

    Expected signal: Web server access log entry: GET /agents HTTP/1.1 from test source IP, no Authorization header, HTTP 200 response with JSON agent listing

  2. Test 2Invoke PraisonAI agent without authentication

    Expected signal: Web server access log entry: POST /invoke HTTP/1.1 from test source IP, no Authorization header, HTTP 200 or 202 response; application log showing agent invocation

  3. Test 3Delete PraisonAI agent configuration without authentication

    Expected signal: Web server access log entry: DELETE /delete HTTP/1.1 from test source IP, no Authorization header; application log showing agent deletion event

  4. Test 4Confirm CALL_SERVER_TOKEN absence in running process

    Expected signal: Process environment read via /proc/<pid>/environ; output contains no CALL_SERVER_TOKEN entry

Last updated: 2026-06-23 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the PraisonAI instance(s) in your environment by checking deployed Python packages (pip show praisonai) and running container inventories; confirm version is <= 4.6.39.
  2. Check whether CALL_SERVER_TOKEN is set in the environment of any PraisonAI call server process (grep CALL_SERVER_TOKEN in environment files, docker-compose configs, and systemd unit files).
  3. Review web server or reverse proxy access logs for requests to /agents, /invoke, and /delete endpoints lacking Authorization Bearer headers in the past 72 hours.
  4. Correlate source IPs from suspicious requests against threat intelligence feeds and internal asset inventory to determine if access was from internal probes, authorized users, or external actors.
  5. Determine which agents were listed, invoked, or deleted: extract agent names and action types from request body logs or application-level audit logs if available.

Containment

  1. Immediately set CALL_SERVER_TOKEN to a cryptographically strong random value (e.g., openssl rand -hex 32) and restart the PraisonAI call server to enforce token-based authentication on all endpoints.
  2. If immediate patching is not possible, block external access to the PraisonAI call server port at the network firewall or reverse proxy level, restricting access to known internal IP ranges only.
  3. Rotate any API keys, credentials, or secrets accessible to PraisonAI agents that may have been exfiltrated or misused during unauthorized agent invocation.

Evidence Collection

  1. Preserve web server access logs covering the exposure window, including full request URIs, source IPs, timestamps, HTTP methods, response codes, and request body sizes for /agents, /invoke, and /delete endpoints.
  2. Capture PraisonAI application logs showing agent invocation history, including agent names, input parameters, and any output data returned to unauthenticated callers.
  3. Export container or process environment variables (excluding secrets) and configuration files to document whether CALL_SERVER_TOKEN was absent from the deployment.

Escalation Criteria

  • !Escalate immediately if evidence shows unauthorized agent invocations executed actions with external side-effects (API calls, file writes, code execution) or accessed sensitive data stores.
  • !Escalate to incident response if more than one external IP address accessed agent endpoints, suggesting active scanning or coordinated exploitation rather than accidental exposure.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs showing HTTP requests to /agents, /invoke, /delete without Authorization: Bearer header
  • >PraisonAI application-level logs in the working directory or container stdout showing agent invocation records
  • >Process environment listing (cat /proc/<pid>/environ) confirming absence of CALL_SERVER_TOKEN at time of exposure
  • >Network flow logs showing inbound connections to PraisonAI call server port from unexpected source IPs

Tuning Guidance

Tune detection by scoping the URL path filter to the specific port and host serving PraisonAI to reduce false positives from unrelated applications. Add a process name filter (praisonai, uvicorn) when EDR telemetry is available. Increase confidence threshold by requiring at least 3 distinct endpoint paths (/agents AND /invoke or /delete) from the same source IP within the window, which strongly indicates reconnaissance followed by exploitation rather than incidental misconfiguration discovery. Suppress alerts for source IPs matching internal monitoring subnets documented in your asset inventory.

Hunting Queries

Threat hunt for historical unauthenticated access to PraisonAI call server endpoints over the past 7 days, identifying source IPs with repeated access and measuring exposure duration to establish blast radius.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/agents", "/invoke", "/delete")
| where isempty(RequestHeader_Authorization)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RequestCount=count(), UniqueEndpoints=dcount(RequestURL) by SourceIP
| where RequestCount > 1
| extend ExposureDurationHours = datetime_diff('hour', LastSeen, FirstSeen)
| order by RequestCount desc
Hunting — SPL
spl 
index=web sourcetype IN ("access_combined", "nginx:access", "iis") earliest=-7d
| where (uri_path="/agents*" OR uri_path="/invoke*" OR uri_path="/delete*")
| eval has_auth=if(like(lower(coalesce(http_request_header, "")), "%authorization: bearer%"), "yes", "no")
| where has_auth="no"
| stats earliest(_time) AS first_seen, latest(_time) AS last_seen, count AS total_requests, dc(uri_path) AS distinct_endpoints BY src_ip
| eval exposure_hours=round((last_seen-first_seen)/3600, 1)
| sort - total_requests

Atomic Red Team Tests

Test 1 Enumerate PraisonAI agents without authentication
linux

Simulates an attacker discovering available agents on an exposed PraisonAI call server by sending an unauthenticated GET request to the /agents endpoint.

Command

bash 
curl -v -X GET http://TARGET_HOST:8000/agents -H 'Content-Type: application/json' 2>&1 | tee /tmp/praisonai_agent_enum.txt

Cleanup

bash 
rm -f /tmp/praisonai_agent_enum.txt

Expected Telemetry

Web server access log entry: GET /agents HTTP/1.1 from test source IP, no Authorization header, HTTP 200 response with JSON agent listing

Expected Detection

Detection rule fires on unauthenticated GET /agents request; alert generated with source IP and endpoint details

Test 2 Invoke PraisonAI agent without authentication
linux

Simulates an attacker invoking an AI agent workflow without providing a Bearer token, exploiting the missing CALL_SERVER_TOKEN guard.

Command

bash 
curl -v -X POST http://TARGET_HOST:8000/invoke -H 'Content-Type: application/json' -d '{"agent_name": "test_agent", "task": "echo hello world"}' 2>&1 | tee /tmp/praisonai_invoke.txt

Cleanup

bash 
rm -f /tmp/praisonai_invoke.txt

Expected Telemetry

Web server access log entry: POST /invoke HTTP/1.1 from test source IP, no Authorization header, HTTP 200 or 202 response; application log showing agent invocation

Expected Detection

Detection rule fires on unauthenticated POST /invoke; high-severity alert generated correlating with prior GET /agents from same source IP

Test 3 Delete PraisonAI agent configuration without authentication
linux

Simulates a destructive attack where an unauthorized actor deletes an agent from the PraisonAI call server without any credentials, exploiting CWE-306.

Command

bash 
curl -v -X DELETE http://TARGET_HOST:8000/delete -H 'Content-Type: application/json' -d '{"agent_name": "test_agent"}' 2>&1 | tee /tmp/praisonai_delete.txt

Cleanup

bash 
rm -f /tmp/praisonai_delete.txt

Expected Telemetry

Web server access log entry: DELETE /delete HTTP/1.1 from test source IP, no Authorization header; application log showing agent deletion event

Expected Detection

Detection rule fires on unauthenticated DELETE /delete; critical-severity alert generated; T1485 Data Destruction technique tagged

Test 4 Confirm CALL_SERVER_TOKEN absence in running process
linux

Validates that a deployed PraisonAI call server is vulnerable by confirming CALL_SERVER_TOKEN is absent from the process environment, establishing preconditions for exploitation.

Command

bash 
PRAISONAI_PID=$(pgrep -f 'uvicorn.*praisonai\|praisonai.*call' | head -1); if [ -n "$PRAISONAI_PID" ]; then cat /proc/$PRAISONAI_PID/environ | tr '\0' '\n' | grep -i 'call_server_token' || echo 'CALL_SERVER_TOKEN NOT SET - VULNERABLE'; fi

Cleanup

bash 
No cleanup required — read-only operation

Expected Telemetry

Process environment read via /proc/<pid>/environ; output contains no CALL_SERVER_TOKEN entry

Expected Detection

No direct detection fired (reconnaissance phase); combine with subsequent network-level detections for full attack chain visibility

Related Detections

Tactic Hubs

TA0001Initial AccessTA0003PersistenceTA0040Impact

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1485Data DestructionT1059Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections