CVE-2026-47396: PraisonAI Call Server Authentication Bypass Allows Unauthenticated Agent Access

Vulnerability Overview

CVE-2026-47396 is a critical authentication bypass (CWE-284 / CWE-306) in the call server component of PraisonAI, a popular open-source multi-agent AI framework distributed via PyPI. The root cause is a missing-authentication guard: when the CALL_SERVER_TOKEN environment variable is not set, the call server skips all token validation and exposes its agent management endpoints to any unauthenticated caller. CVSS 9.8 (Critical) reflects the trivial exploitation path and the breadth of impact — an attacker gains full control over agent orchestration with no credentials required.

Affected Software

• Package: praisonai (PyPI / pip)
• Versions: all releases up to and including 4.6.39
• Patch status: no patch released as of the time of writing

Exploitation Status

A public proof-of-concept is available. The vulnerability was disclosed on 29 May 2026. Because the bypass requires only that the target server was started without CALL_SERVER_TOKEN set — a common default posture in development and containerised deployments — exploitation is low-complexity and likely to be encountered in the wild rapidly. Defenders should treat this as an actively exploitable issue until a patch lands. Organisations running PraisonAI call servers that are reachable from untrusted networks are at immediate risk.

What an attacker can do

• Enumerate all registered AI agents (information disclosure)
• Invoke arbitrary agent workflows (remote code / command execution via agent logic)
• Delete agent configurations (denial of service / sabotage)

Detection Coverage

Our detection logic targets the network-visible symptoms of exploitation: unauthenticated HTTP requests to the call server's agent management endpoints. Because no token header is present in bypass requests, this manifests as anonymous access patterns to paths such as agent list, invoke, and delete routes — distinct from legitimate authenticated traffic.

We ship native queries across seven SIEM platforms:

• Microsoft Sentinel (KQL) — correlates web access logs for missing or empty Authorization headers on call-server routes, with a threshold filter to suppress incidental noise.
• Splunk (SPL) — searches HTTP event data for anonymous agent-endpoint requests, enriched with source IP and user-agent context.
• Elastic (EQL) — event sequence detecting repeated unauthenticated calls to agent management paths within a short window.
• IBM QRadar (AQL) — log source query scoped to PraisonAI process events and web log sources, flagging token-absent requests.
• Sumo Logic (CQL) — keyword and field-extraction search over ingested container or application logs.
• Chronicle (YARA-L) — rule matching HTTP metadata events with absent authentication fields targeting known endpoint patterns.
• CrowdStrike (CQL) — Falcon LogScale query correlating network event telemetry with process context from the PraisonAI process tree.

All queries ship with tuning guidance to help reduce false positives in environments where the call server is intentionally internal-only.

Next Steps

Until a patched release is available, operators should ensure CALL_SERVER_TOKEN is set to a strong, unique value on every PraisonAI call server instance, and that the call server port is not exposed to untrusted networks. View the full detection, including SIEM queries, playbook, and atomic test cases, on the CVE-2026-47396 detection page.