CVE-2026-47393: PraisonAI Flask API Server Deployed Without Authentication

Vulnerability Overview

CVE-2026-47393 is a missing authentication vulnerability (CWE-306, CWE-1188) in PraisonAI's built-in Flask HTTP server. When an operator runs deploy --type api, the framework spins up a Flask API server with authentication disabled by default. There is no credential challenge, no API key enforcement, and no network binding restriction applied out of the box. Any actor with network-level access to the listening port can call the API as though they were an authorized client.

The impact is severe: unauthenticated callers can invoke AI agent workflows, extract model outputs (including any sensitive data passed through prompts), and potentially use the exposed endpoint as a pivot for downstream attacks against internal infrastructure. The vulnerability carries a CVSS score of 9.8 Critical.

Affected Software

• Product: PraisonAI (distributed via pip)
• Affected versions: <= 4.6.39
• Deployment condition: Only systems where deploy --type api has been invoked are exposed

At the time of writing, no patched version has been released. Defenders should treat all PraisonAI deployments at or below 4.6.39 as vulnerable if the API deployment mode is in use.

Exploitation Status

A public proof-of-concept (PoC) is available. This moves the vulnerability from theoretical to actively exploitable by low-skilled actors. The disclosed date is 2026-05-29 and no vendor patch has been issued, meaning the attack surface remains fully open. Organisations running PraisonAI in API mode should assume opportunistic scanning is already underway and treat this as an emergency configuration issue until a patch or compensating control is in place.

How Our Detection Catches It

Our detection rule set targets the behavioral indicators associated with unauthenticated access to a PraisonAI Flask endpoint — specifically, successful HTTP responses to the agent API paths from source addresses that have no prior authenticated session, unusually high request rates from single clients, and process-level telemetry showing Flask binding on non-loopback interfaces.

We ship coverage across seven SIEM platforms:

• Microsoft Sentinel (KQL) — correlates network flow and HTTP access logs for unauthenticated 200-series responses to known PraisonAI API routes
• Splunk (SPL) — searches web and process logs for Flask process spawned by PraisonAI with outbound listener on 0.0.0.0 or a non-localhost address
• Elastic (EQL) — event sequence detection tying the deploy --type api process execution to subsequent inbound connections without auth headers
• IBM QRadar (AQL) — flow-based rule matching unauthenticated API calls against the PraisonAI endpoint signature
• Sumo Logic — log search query targeting Flask access logs for missing Authorization headers on agent endpoints
• Google Chronicle (YARAL) — UDM rule correlating HTTP metadata with the absence of authentication context
• CrowdStrike (CQL) — process and network telemetry correlation for PraisonAI API listener exposure

The detection logic does not rely on vulnerability scanning — it focuses on runtime evidence of the misconfiguration being exploited or exposed, making it effective even in environments where asset inventory is incomplete.

Remediation Guidance

• Immediately disable or firewall any PraisonAI API deployments until a patched version is available
• If the API must remain running, place it behind a reverse proxy (nginx, Caddy) with mandatory authentication enforced at the proxy layer
• Restrict network binding to localhost (127.0.0.1) and use SSH tunnelling or a VPN for remote access
• Monitor for the IOCs covered by our detection rules and alert on any unauthenticated access attempts

Full detection queries, MITRE ATT&CK mapping, and platform-specific deployment notes are available on the CVE-2026-47393 detection page. A df00tech subscription gives you production-ready rules for all seven SIEM platforms listed above, plus atomic test cases for validating coverage in your environment.