CVE-2026-47396

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALL_SERVER_TOKEN is not configured. The affected component is the praisonai.api.agent_invoke router as mounted by praisonai.api.call. The authentication helper verify_token() fails open when CALL_SERVER_TOKEN is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to 0.0.0.0. As a result, operators who launch the call server without explicitly setting CALL_SERVER_TOKEN may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALL_SERVER_TOKEN is not configured. The affected component is the praisonai.api.agent_invoke router as mounted by praisonai.api.call. The authentication helper verify_token() fails open when CALL_SERVER_TOKEN is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to 0.0.0.0. As a result, operators who launch the call server without explicitly setting CALL_SERVER_TOKEN may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.

Summary

PraisonAI's call server exposes a network-facing agent control API without authentication when CALL_SERVER_TOKEN is not configured.

The affected component is the praisonai.api.agent_invoke router as mounted by praisonai.api.call. The authentication helper verify_token() fails open when CALL_SERVER_TOKEN is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents.

This is security-relevant because the bundled call server includes the vulnerable router and binds to 0.0.0.0. As a result, operators who launch the call server without explicitly setting CALL_SERVER_TOKEN may unintentionally expose an unauthenticated remote agent control plane.

Details

The vulnerable behavior is caused by a fail-open authentication default.

In praisonai/api/agent_invoke.py, CALL_SERVER_TOKEN is read from the environment:

CALL_SERVER_TOKEN = os.getenv('CALL_SERVER_TOKEN')

The authentication dependency then returns successfully when the token is not configured:

async def verify_token(request: Request, authorization: Optional[str] = Header(None)) -> None:
    if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:
        return  # No authentication if FastAPI unavailable or no token set

This means that the absence of CALL_SERVER_TOKEN disables authentication entirely.

The same helper is used by sensitive agent-control routes, including:

@router.post("/agents/{agent_id}/invoke")
async def invoke_agent(..., _: None = Depends(verify_token))

@router.get("/agents")
async def list_agents(_: None = Depends(verify_token))

@router.delete("/agents/{agent_id}")
async def unregister_agent_endpoint(agent_id: str, _: None = Depends(verify_token))

@router.get("/agents/{agent_id}")
async def get_agent_info(agent_id: str, _: None = Depends(verify_token))

These endpoints allow a caller to:

• list registered agents;
• retrieve agent metadata;
• retrieve agent instruction text;
• invoke agents;
• unregister agents.

The vulnerable router is mounted by the call server:

from .agent_invoke import router as agent_invoke_router
app.include_router(agent_invoke_router)

The call server then listens on all interfaces:

uvicorn.run(app, host="0.0.0.0", port=port, log_level="warning")

Therefore, when praisonai-call is started without CALL_SERVER_TOKEN, the agent-control API becomes reachable without authentication from any client that can access the server.

PoC

The following local PoC imports the real praisonai.api.agent_invoke router from source, ensures CALL_SERVER_TOKEN is absent, registers a demo agent, mounts the router into a local FastAPI app, and sends unauthenticated requests to the vulnerable endpoints.

The PoC proves that, without sending any authentication material:

1. GET /api/v1/agents returns the list of registered agents.
2. GET /api/v1/agents/{agent_id} exposes agent metadata and instructions.
3. POST /api/v1/agents/{agent_id}/invoke executes the registered agent.
4. DELETE /api/v1/agents/{agent_id} unregisters the agent.

Run with:

PRAISONAI_REPO=/path/to/PraisonAI python -B embedded_poc.py

Full PoC:

#!/usr/bin/env python3
from __future__ import annotations

import os
import sys
from pathlib import Path
from types import SimpleNamespace


REPO_ROOT = Path(os.environ.get("PRAISONAI_REPO", "/path/to/PraisonAI")).resolve()
PRAISON_ROOT = REPO_ROOT / "src" / "praisonai"


def verify_source() -> None:
    expected = {
        PRAISON_ROOT / "praisonai/api/agent_invoke.py": [
            "CALL_SERVER_TOKEN = os.getenv('CALL_SERVER_TOKEN')",
            "if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:",
            '@router.post("/agents/{agent_id}/invoke")',
            '@router.get("/agents")',
           …

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALL_SERVER_TOKEN is not configured. The affected component is the praisonai.api.agent_invoke router as mounted by praisonai.api.call. The authentication helper verify_token() fails open when CALL_SERVER_TOKEN is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to 0.0.0.0. As a result, operators who launch the call server without explicitly setting CALL_SERVER_TOKEN may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALL_SERVER_TOKEN is not configured. The affected component is the praisonai.api.agent_invoke router as mounted by praisonai.api.call. The authentication helper verify_token() fails open when CALL_SERVER_TOKEN is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents. This is security-relevant because the bundled call server includes the vulnerable router and binds to 0.0.0.0. As a result, operators who launch the call server without explicitly setting CALL_SERVER_TOKEN may unintentionally expose an unauthenticated remote agent control plane. Version 4.6.40 fixes the issue.

Summary

PraisonAI's call server exposes a network-facing agent control API without authentication when CALL_SERVER_TOKEN is not configured.

The affected component is the praisonai.api.agent_invoke router as mounted by praisonai.api.call. The authentication helper verify_token() fails open when CALL_SERVER_TOKEN is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents.

This is security-relevant because the bundled call server includes the vulnerable router and binds to 0.0.0.0. As a result, operators who launch the call server without explicitly setting CALL_SERVER_TOKEN may unintentionally expose an unauthenticated remote agent control plane.

Details

The vulnerable behavior is caused by a fail-open authentication default.

In praisonai/api/agent_invoke.py, CALL_SERVER_TOKEN is read from the environment:

CALL_SERVER_TOKEN = os.getenv('CALL_SERVER_TOKEN')

The authentication dependency then returns successfully when the token is not configured:

async def verify_token(request: Request, authorization: Optional[str] = Header(None)) -> None:
    if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:
        return  # No authentication if FastAPI unavailable or no token set

This means that the absence of CALL_SERVER_TOKEN disables authentication entirely.

The same helper is used by sensitive agent-control routes, including:

@router.post("/agents/{agent_id}/invoke")
async def invoke_agent(..., _: None = Depends(verify_token))

@router.get("/agents")
async def list_agents(_: None = Depends(verify_token))

@router.delete("/agents/{agent_id}")
async def unregister_agent_endpoint(agent_id: str, _: None = Depends(verify_token))

@router.get("/agents/{agent_id}")
async def get_agent_info(agent_id: str, _: None = Depends(verify_token))

These endpoints allow a caller to:

• list registered agents;
• retrieve agent metadata;
• retrieve agent instruction text;
• invoke agents;
• unregister agents.

The vulnerable router is mounted by the call server:

from .agent_invoke import router as agent_invoke_router
app.include_router(agent_invoke_router)

The call server then listens on all interfaces:

uvicorn.run(app, host="0.0.0.0", port=port, log_level="warning")

Therefore, when praisonai-call is started without CALL_SERVER_TOKEN, the agent-control API becomes reachable without authentication from any client that can access the server.

PoC

The following local PoC imports the real praisonai.api.agent_invoke router from source, ensures CALL_SERVER_TOKEN is absent, registers a demo agent, mounts the router into a local FastAPI app, and sends unauthenticated requests to the vulnerable endpoints.

The PoC proves that, without sending any authentication material:

1. GET /api/v1/agents returns the list of registered agents.
2. GET /api/v1/agents/{agent_id} exposes agent metadata and instructions.
3. POST /api/v1/agents/{agent_id}/invoke executes the registered agent.
4. DELETE /api/v1/agents/{agent_id} unregisters the agent.

Run with:

PRAISONAI_REPO=/path/to/PraisonAI python -B embedded_poc.py

Full PoC:

#!/usr/bin/env python3
from __future__ import annotations

import os
import sys
from pathlib import Path
from types import SimpleNamespace


REPO_ROOT = Path(os.environ.get("PRAISONAI_REPO", "/path/to/PraisonAI")).resolve()
PRAISON_ROOT = REPO_ROOT / "src" / "praisonai"


def verify_source() -> None:
    expected = {
        PRAISON_ROOT / "praisonai/api/agent_invoke.py": [
            "CALL_SERVER_TOKEN = os.getenv('CALL_SERVER_TOKEN')",
            "if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:",
            '@router.post("/agents/{agent_id}/invoke")',
            '@router.get("/agents")',
           …

Summary

PraisonAI's call server exposes a network-facing agent control API without authentication when CALL_SERVER_TOKEN is not configured.

The affected component is the praisonai.api.agent_invoke router as mounted by praisonai.api.call. The authentication helper verify_token() fails open when CALL_SERVER_TOKEN is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents.

This is security-relevant because the bundled call server includes the vulnerable router and binds to 0.0.0.0. As a result, operators who launch the call server without explicitly setting CALL_SERVER_TOKEN may unintentionally expose an unauthenticated remote agent control plane.

Details

The vulnerable behavior is caused by a fail-open authentication default.

In praisonai/api/agent_invoke.py, CALL_SERVER_TOKEN is read from the environment:

CALL_SERVER_TOKEN = os.getenv('CALL_SERVER_TOKEN')

The authentication dependency then returns successfully when the token is not configured:

async def verify_token(request: Request, authorization: Optional[str] = Header(None)) -> None:
    if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:
        return  # No authentication if FastAPI unavailable or no token set

This means that the absence of CALL_SERVER_TOKEN disables authentication entirely.

The same helper is used by sensitive agent-control routes, including:

@router.post("/agents/{agent_id}/invoke")
async def invoke_agent(..., _: None = Depends(verify_token))

@router.get("/agents")
async def list_agents(_: None = Depends(verify_token))

@router.delete("/agents/{agent_id}")
async def unregister_agent_endpoint(agent_id: str, _: None = Depends(verify_token))

@router.get("/agents/{agent_id}")
async def get_agent_info(agent_id: str, _: None = Depends(verify_token))

These endpoints allow a caller to:

• list registered agents;
• retrieve agent metadata;
• retrieve agent instruction text;
• invoke agents;
• unregister agents.

The vulnerable router is mounted by the call server:

from .agent_invoke import router as agent_invoke_router
app.include_router(agent_invoke_router)

The call server then listens on all interfaces:

uvicorn.run(app, host="0.0.0.0", port=port, log_level="warning")

Therefore, when praisonai-call is started without CALL_SERVER_TOKEN, the agent-control API becomes reachable without authentication from any client that can access the server.

PoC

The following local PoC imports the real praisonai.api.agent_invoke router from source, ensures CALL_SERVER_TOKEN is absent, registers a demo agent, mounts the router into a local FastAPI app, and sends unauthenticated requests to the vulnerable endpoints.

The PoC proves that, without sending any authentication material:

1. GET /api/v1/agents returns the list of registered agents.
2. GET /api/v1/agents/{agent_id} exposes agent metadata and instructions.
3. POST /api/v1/agents/{agent_id}/invoke executes the registered agent.
4. DELETE /api/v1/agents/{agent_id} unregisters the agent.

Run with:

PRAISONAI_REPO=/path/to/PraisonAI python -B embedded_poc.py

Full PoC:

#!/usr/bin/env python3
from __future__ import annotations

import os
import sys
from pathlib import Path
from types import SimpleNamespace


REPO_ROOT = Path(os.environ.get("PRAISONAI_REPO", "/path/to/PraisonAI")).resolve()
PRAISON_ROOT = REPO_ROOT / "src" / "praisonai"


def verify_source() -> None:
    expected = {
        PRAISON_ROOT / "praisonai/api/agent_invoke.py": [
            "CALL_SERVER_TOKEN = os.getenv('CALL_SERVER_TOKEN')",
            "if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:",
            '@router.post("/agents/{agent_id}/invoke")',
            '@router.get("/agents")',
           …