CVE-2026-47394

{"id": "CVE-2026-47394", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47394", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T18:00:46.506651Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MervinPraison", "product": "PraisonAI", "versions": [{"status": "affected", "version": "< 4.6.40"}]}]}], "published": "2026-07-21T16:17:12.440", "references": [{"url": "https://github.com/MervinPraison/PraisonAI/commit/b0d8f777528f3253a0cfb0a3ef65455da6ae32f6", "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/pull/1684", "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cr9-25q5-8prj", "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cr9-25q5-8prj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in `mcp_server/adapters/cli_tools.py`. Commit `68cc9427` (\"fix(security): harden MCP rules path handling\u2026\") added a `_resolve_rule_path()` helper and applied it to `rules.create`, `rules.show`, and `rules.delete`. `workflow.show` was left unchanged. Two adjacent handlers in the same file have the same pattern, `workflow.validate` and `deploy.validate`. Neither was mentioned in the original advisory. Both remained unchanged. The original advisory also identified the dispatcher (`server.py:281-298`) as a root cause. It accepts unvalidated `**kwargs` from `params[\"arguments\"]` with no enforcement against the tool's declared `input_schema`. That code is unchanged prior to version 4.6.40. A single unauthenticated MCP `tools/call` to `praisonai.workflow.show` returns the contents of any file the host user can read: `/etc/passwd`, `~/.ssh/id_rsa`, `~/.aws/credentials`, or any project `.env`. Version 4.6.40 contains an updated fix."}, {"lang": "es", "value": "PraisonAI es un sistema de equipos multiagente. Antes de la versi\u00f3n 4.6.40, la correcci\u00f3n para GHSA-9mqq-jqxf-grvw / CVE-2026-44336 est\u00e1 incompleta. La descripci\u00f3n del aviso original nombr\u00f3 cuatro manejadores vulnerables en \u201cmcp_server/adapters/cli_tools.py\u201d. El commit \u201c68cc9427\u201d (\u2019fix(security): harden MCP rules path handling...\u2019) a\u00f1adi\u00f3 una funci\u00f3n auxiliar \u201c_resolve_rule_path()\u201d y la aplic\u00f3 a \u201crules.create\u201d, \u201crules.show\u201d, y \u201crules.delete\u201d. \u201cworkflow.show\u201d se dej\u00f3 sin cambios. Dos manejadores adyacentes en el mismo archivo tienen el mismo patr\u00f3n, \u201cworkflow.validate\u201d y \u201cdeploy.validate\u201d. Ninguno de los dos fue mencionado en el aviso original. Ambos permanecieron sin cambios. El aviso original tambi\u00e9n identific\u00f3 el despachador (\u201cserver.py:281-298\u201d) como una causa ra\u00edz. Acepta \u201ckwargs\u201d no validados de \u201cparams[\u2019arguments\u2019]\u201d sin aplicaci\u00f3n de restricciones contra el \u201cinput_schema\u201d declarado de la herramienta. Ese c\u00f3digo est\u00e1 sin cambios antes de la versi\u00f3n 4.6.40. Una \u00fanica llamada \u201ctools/call\u201d de MCP no autenticada a \u201cpraisonai.workflow.show\u201d devuelve el contenido de cualquier archivo que el usuario del host pueda leer: \u201c/etc/p4ssd\u201d, \u201c~/.ssh/id_rsa\u201d, \u201c~/.aws/credentials\u201d, o cualquier archivo \u201c.env\u201d del proyecto. La versi\u00f3n 4.6.40 contiene una correcci\u00f3n actualizada."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "security-advisories@github.com"}