{"id":15353,"date":"2026-09-04T19:02:36","date_gmt":"2026-09-04T11:02:36","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-47396"},"modified":"2026-09-04T19:02:36","modified_gmt":"2026-09-04T11:02:36","slug":"cve-2026-47396","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-47396","title":{"rendered":"CVE-2026-47396 [CRITICAL] &#8211; PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI&#8217;s call server"},"content":{"rendered":"<p>PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI&#8217;s call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI&#8217;s call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15353","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}