CVE-2026-47391

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can invoke the registered `calculate` tool. In testing with `gemini/gemini-2.5-flash-lite`, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.

• CWE-95
• CWE-306

• https://github.com/MervinPraison/PraisonAI/commit/e0fb8e7dd1ee6759c18ed07f436c21dbd9c20747
• https://github.com/MervinPraison/PraisonAI/pull/1793
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg22-4gmj-prxw
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg22-4gmj-prxw

Published

Jul 21, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47386NocoDB is software for building databases as spreadsheets. P…6.3
• CVE-2026-47387NocoDB is software for building databases as spreadsheets. P…8.4
• CVE-2026-47388NocoDB is software for building databases as spreadsheets. P…2.3
• CVE-2026-47389Mastodon is a free, open-source social network server based …8.6
• CVE-2026-4739Integer Overflow or Wraparound vulnerability in InsightSoftw…9.4
• CVE-2026-47390PraisonAI is a multi-agent teams system. Prior to version 4.…5.5
• CVE-2026-47392PraisonAI is a multi-agent teams system. Prior to version 4.…9.9
• CVE-2026-47393PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHS…9.8
• CVE-2026-47394PraisonAI is a multi-agent teams system. Prior to version 4.…8.7
• CVE-2026-47395PraisonAI is a multi-agent teams system. Prior to version 4.…5.5
• CVE-2026-47396PraisonAI is a multi-agent teams system. Prior to version 4.…9.8
• CVE-2026-47397PraisonAI is a multi-agent teams system. Prior to version 4.…7.1