CVE-2026-47393
CVE-2026-47393 allows attackers to access unauthenticated Flask API endpoints in PraisonAI versions prior to 4.6.40, enabling potential data exposure or manipulation. The vulnerability stems from a code-generator that defaults to disabling authentication.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of PraisonAI versions before 4.6.40 who deploy API servers via the documented quickstart method.
Real-world impact
Unauthenticated access to /chat and /agents endpoints could allow attackers to interact with LLM orchestration processes, potentially leading to data breaches or service disruption.
Why this severity
CVSS 9.8 (Critical): High confidence in exploitation due to network accessibility, no authentication requirements, and potential for high impact on confidentiality, integrity, and availability.
What to do about it
- 01Upgrade PraisonAI to version 4.6.40 or later to apply the authentication fix.
NVD-referenced vendor advisory
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.