HighVulnerability
GHSA-9cr9-25q5-8prj: PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate
- Identifiers
- CVE-2026-47394GHSA-9cr9-25q5-8prj
- Published
- Record updated
- Affected
- PraisonAI <= 4.6.39
- Fixed in
- 4.6.40
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
The fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. Commit 68cc9427 added _resolve_rule_path() to rules.create, rules.show and rules.delete in mcp_server/adapters/cli_tools.py, but praisonai.workflow.show, praisonai.workflow.validate and praisonai.deploy.validate remain unchanged. A single unauthenticated MCP tools/call to praisonai.workflow.show can return any file the host user can read, and the dispatcher in server.py, which passes unvalidated arguments as **kwargs, is also unchanged.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
- HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
- InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
- LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
- MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database