CVE-2026-47391: PraisonAI Unauthenticated A2A LLM eval() Remote Code Execution (CVSS 9.8)

Vulnerability Overview

CVE-2026-47391 is a critical remote code execution vulnerability (CVSS 9.8) rooted in two compounding weaknesses: improper neutralisation of code in a dynamically-evaluated expression (CWE-95) and missing authentication for a critical function (CWE-306). The official Agent-to-Agent (A2A) example bundled with PraisonAI exposes an HTTP endpoint that accepts arbitrary attacker-controlled input, feeds it into an LLM-driven pipeline, and then passes the model's output directly to Python's built-in eval() — with no authentication gate and no input sanitisation at any stage of that chain. Because the LLM's output is fully controlled by the attacker's prompt, an adversary can reliably coerce the model into emitting arbitrary Python that the server executes under the privileges of the PraisonAI process.

Affected Software

• Package: PraisonAI (PyPI / pip)
• Affected versions: <= 4.6.39
• Patch status: No patch available at time of publication (2026-05-29)

Exploitation Status

A public proof-of-concept is available. The attack surface is unauthenticated and network-reachable, making exploitation trivial for any attacker with visibility to the A2A endpoint. Defenders should treat this as actively exploitable: the combination of a public PoC, zero authentication requirement, and direct eval() execution means the barrier to weaponisation is extremely low. Any PraisonAI deployment exposing the A2A endpoint to an untrusted network should be treated as compromised until the service is isolated or the vulnerable code path is disabled.

Detection Coverage

df00tech ships detections for CVE-2026-47391 across seven SIEM platforms. The detection strategy focuses on three complementary angles:

• Process spawn telemetry: Queries target anomalous child processes spawned by the PraisonAI service — interpreter forks, shell invocations, and network utility launches that are inconsistent with normal agent operation.
• A2A endpoint abuse: HTTP/API log queries look for high-rate or structurally anomalous requests to the A2A route, particularly payloads containing prompt-injection markers or oversized instruction blocks characteristic of jailbreak attempts.
• Eval-path code patterns: Where application logging captures LLM output before execution, queries flag responses containing Python execution primitives (os.system, subprocess, __import__, etc.).

Coverage is provided for Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL).

Recommendations

• Immediately restrict network access to the A2A endpoint to trusted hosts only.
• Audit all PraisonAI deployments for version <= 4.6.39 and monitor process spawn activity from the service account.
• Never pass LLM output to eval(), exec(), or any dynamic execution primitive without a strict allowlist — LLM output is attacker-controlled by design.
• Deploy the detections below and alert on any hits at high priority until a vendor patch is available.

Full KQL, SPL, EQL, AQL, Sumo Logic, Chronicle YARA-L, and CrowdStrike CQL queries — along with playbook guidance and atomic test cases — are available on the CVE-2026-47391 detection page.