CVE-2026-47396 describes an improper access control vulnerability (CWE-284) in MervinPraison's PraisonAI call server prior to version 4.6.40. The call server exposes a network-facing agent control API that relies on an authentication helper verify_token(). If the environment variable CALL_SERVER_TOKEN is unset, verify_token() fails open, effectively disabling authentication. Consequently, any client reachable on the network can perform sensitive operations such as listing agents, viewing agent metadata and instructions, invoking agents, and unregistering them. The call server binds to 0.0.0.0, making this unauthenticated access remotely exploitable. The vulnerability is fixed in version 4.6.40.

An attacker who can reach the PraisonAI call server on the network can gain unauthorized control over agent operations without authentication. This includes full confidentiality, integrity, and availability impact on the agent control plane, as attackers can list, inspect, invoke, and unregister agents remotely. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade PraisonAI to version 4.6.40 or later, where the authentication helper verify_token() no longer fails open when CALL_SERVER_TOKEN is unset. Until upgrading, ensure that the environment variable CALL_SERVER_TOKEN is explicitly configured with a secure token before starting the call server to enforce authentication. Since this is a software configuration and code issue, no other mitigations are directly applicable.