CVE-2026-47394— PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mervin Praison PraisonAI是Mervin Praison个人开发者开源的一个低代码多智能体协作框架。 Mervin Praison PraisonAI 4.6.40之前版本存在安全漏洞，该漏洞源于MCP规则路径处理未完成修复，导致未经身份验证的攻击者通过MCP tools/call请求可读取宿主系统上的任意文件。
Possible ATT&CK Techniques 3 AI
T1005 · Data from Local System T1059 · Command and Scripting Interpreter T1552 · Unsecured CredentialsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MervinPraison | PraisonAI | < 4.6.40 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47394
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in `mcp_server/adapters/cli_tools.py`. Commit `68cc9427` ("fix(security): harden MCP rules path handling…") added a `_resolve_rule_path()` helper and applied it to `rules.create`, `rules.show`, and `rules.delete`. `workflow.show` was left unchanged. Two adjacent handlers in the same file have the same pattern, `workflow.validate` and `deploy.validate`. Neither was mentioned in the original advisory. Both remained unchanged. The original advisory also identified the dispatcher (`server.py:281-298`) as a root cause. It accepts unvalidated `**kwargs` from `params["arguments"]` with no enforcement against the tool's declared `input_schema`. That code is unchanged prior to version 4.6.40. A single unauthenticated MCP `tools/call` to `praisonai.workflow.show` returns the contents of any file the host user can read: `/etc/passwd`, `~/.ssh/id_rsa`, `~/.aws/credentials`, or any project `.env`. Version 4.6.40 contains an updated fix.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Mervin Praison PraisonAI 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mervin Praison PraisonAI是Mervin Praison个人开发者开源的一个低代码多智能体协作框架。 Mervin Praison PraisonAI 4.6.40之前版本存在安全漏洞，该漏洞源于MCP规则路径处理未完成修复，导致未经身份验证的攻击者通过MCP tools/call请求可读取宿主系统上的任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | < 4.6.40 | - |
|
II. Public POCs for CVE-2026-47394
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47394
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47394 (1)
Same Patch Batch · MervinPraison · 2026-07-21 · 25 CVEs total
| CVE-2026-47392 | 9.9 CRITICAL | PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execu |
| CVE-2026-47393 | 9.8 CRITICAL | PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default |
| CVE-2026-47396 | 9.8 CRITICAL | PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when |
| CVE-2026-47391 | 9.8 CRITICAL | PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool e |
| CVE-2026-47410 | 9.8 CRITICAL | praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing |
| CVE-2026-47413 | 9.6 CRITICAL | praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspa |
| CVE-2026-47416 | 9.6 CRITICAL | praisonai-platform: Any workspace member can promote themselves (or any other member) to o |
| CVE-2026-47405 | 8.8 HIGH | PraisonAI Platform missing role checks let any workspace member become owner and take over |
| CVE-2026-47399 | 8.8 HIGH | PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global o |
| CVE-2026-47415 | 8.3 HIGH | praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, |
| CVE-2026-47419 | 8.3 HIGH | praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, |
| CVE-2026-47409 | 8.1 HIGH | praisonai-platform: Any workspace member can remove any other member (including the owner) |
| CVE-2026-47417 | 8.1 HIGH | praisonai-platform: Comment endpoints accept any issue_id without workspace ownership chec |
| CVE-2026-47412 | 8.1 HIGH | praisonai-platform: Any workspace member can delete the entire workspace via DELETE /works |
| CVE-2026-47418 | 8.1 HIGH | praisonai-platform: Project endpoints accept any project_id without workspace ownership ch |
| CVE-2026-47406 | 8.1 HIGH | praisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace |
| CVE-2026-47398 | 8.1 HIGH | PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_gen |
| CVE-2026-47414 | 7.6 HIGH | praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace |
| CVE-2026-47397 | 7.1 HIGH | PraisonAI has an Arbitrary File Write in Python API |
| CVE-2026-47408 | 6.5 MEDIUM | praisonai-platform: list_issue_activity returns activity log for any issue regardless of w |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow
Same vendor: MervinPraison
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow
Same weakness: CWE-22
-
CVE-2026-116046
eventcatalog sdk Custom Documentation Helpers custom-docs.ts -
CVE-2026-116045
1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_refe -
CVE-2026-115932
Path traversal in post media lets any registered user read s -
CVE-2026-116009
Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_ -
CVE-2026-115800
UbiquitousLearning mllm Convertor __init__.py load_model pat