CVE-2026-47391
PraisonAI’s first‑party A2A server example before version 4.6.40 exposes an unauthenticated JSON‑RPC endpoint that allows remote code execution via a Python eval() tool. The server listens on all interfaces, so any internet‑connected attacker can trigger the vulnerability. The issue is fixed in version 4.6.40.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of PraisonAI’s multi‑agent teams system running any version earlier than 4.6.40 that follows the default A2A example or similar unauthenticated deployments with unsafe tools.
Real-world impact
An attacker can send a crafted request to the /a2a endpoint, causing the server to execute arbitrary Python code. This can lead to full compromise of the server, including data theft, modification, or creation of files on the host.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network without authentication, with no user interaction required, and provides complete confidentiality, integrity, and availability impact.
What to do about it
- 01Upgrade PraisonAI to version 4.6.40 or later.
- 02Restart the PraisonAI service to ensure the new version is running.
NVD-referenced vendor advisory
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.