CVE-2026-47391

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 1.50%
EPSS Percentile: 74.22%
CISA KEV: Not listed

Description

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can invoke the registered `calculate` tool. In testing with `gemini/gemini-2.5-flash-lite`, this resulted in arbitrary Python execution in the server process, confirmed by creation of a marker file from an unauthenticated HTTP request. The issue affects deployments following the official A2A example or similar unauthenticated public A2A deployments with unsafe tools. The default unauthenticated A2A surface also exposes task history and task cancellation APIs, increasing confidentiality and integrity impact. Version 4.6.40 patches the issue.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 21-Jul-2026 23:17
Last Modified: 25-Oct-2026 03:10
EPSS Date: 2026-10-30
CWE: CWE-95, CWE-306

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 31-Oct-2026 07:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

A separate threat actor exploited PraisonAI’s first-party Agent-to-Agent (A2A) server example (CVE-2026-47391 / GHSA-vg22-4gmj-prxw), which exposes an unauthenticated calculate(expression) tool implemented as Python Sysdig Tracks CTF-Framed LLM Jailbreaks Behind Exploit Attempts on AI Tools

CVE (11)

MITRE ATT&CK (4)

Products (8)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.