External risk intelligence

PraisonAI Unauthenticated Python Eval RCE in A2A Server Example.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-47391

The vulnerability exists in an example A2A server implementation that explicitly binds to 0.0.0.0 and exposes an unauthenticated JSON-RPC endpoint. Because this configuration is provided as an official example for developers to deploy agentic services, it is likely to be exposed as an internet-facing API endpoint in deployments following the product's documentation.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the PraisonAI system, specifically affecting its example A2A server. The issue allows unauthenticated remote attackers to execute arbitrary code on affected systems by sending specially crafted requests. This could lead to a significant compromise of confidentiality, integrity, and availability for systems that deploy this example or similar configurations without proper security hardening.

Unauthenticated code execution risk.
Affects AI agent-to-agent communication.
Verify system exposure and secure configurations.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted message to the A2A server's unauthenticated endpoint. This request can trigger an LLM to invoke a tool that uses Python's `eval()` function with attacker-controlled input, leading to arbitrary code execution on the server. This could allow an attacker to create files on the server, potentially impacting the confidentiality and integrity of task history and cancellation functions.

Unauthenticated access to A2A endpoint.
Invoking the `calculate` tool with malicious input.
Arbitrary Python execution, impacting confidentiality and integrity.

Live Threat

Current exploitation, exposure, and threat context

When the PraisonAI A2A server example is deployed with an unauthenticated endpoint and includes the vulnerable `calculate` tool, it could allow remote attackers to execute arbitrary Python code on the server. This could affect the confidentiality and integrity of task history and task cancellation APIs if those are exposed.

Arbitrary Python code execution on server.
Exploits unauthenticated A2A endpoint.
Compromises system integrity and confidentiality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in PraisonAI's A2A server example requires immediate attention from platform or application owners responsible for its deployment. The first critical step is to identify all instances of the affected PraisonAI A2A server, confirm its reachability from external networks, and assess its business criticality to prioritize remediation efforts. Coordinating with the vendor or internal development teams for a timely fix is essential to mitigate the risk of arbitrary code execution.

Platform or application owners should own remediation.
Verify external reachability and business criticality first.
Plan for vendor coordination and apply updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI and its A2A server?

PraisonAI is a framework used to build teams of autonomous AI agents that communicate and collaborate. The A2A (Agent-to-Agent) server component is an interface designed to facilitate these agent interactions, allowing them to exchange messages and perform tasks. It is often deployed by developers as a service to manage agentic workflows, sometimes using provided example configurations to establish communication endpoints.

What is the vulnerability in CVE-2026-47391?

This vulnerability involves Improper Neutralization of Special Elements used in an OS Command (CWE-78/CWE-95) and Missing Authentication for Critical Function (CWE-306). Essentially, the server provides an unauthenticated endpoint that lets remote users trigger functions. Because the server uses a dangerous 'eval()' function to process calculations, an attacker can input arbitrary Python code that the server executes directly, leading to full system control.

How does an attacker trigger this bug?

An attacker sends a specially crafted message to the A2A server's `/a2a` endpoint. This message causes the system's LLM to run a 'calculate' tool. The vulnerability does not trigger if the A2A server is not running, or if it has been configured with authentication that restricts access to the JSON-RPC endpoint. It specifically targets implementations using the vulnerable example code that allows public, unauthenticated access.

Is my PraisonAI deployment at risk?

If you are using the official A2A server example, your system is likely at risk. According to Halo Surface Signal, this implementation binds to '0.0.0.0' by default, meaning it is reachable by any network interface, including the internet. You should care if your server is exposed externally, as this allows remote, unauthenticated attackers to exploit the flaw without needing any prior system access or credentials.

How do I secure my PraisonAI A2A server?

The primary fix is to update your PraisonAI installation to version 4.6.40 or later. Before updating, audit your environment to find all running A2A server instances and confirm if they are exposed to the network. If you cannot update immediately, restrict network access to the server so that it is not publicly reachable. Always prioritize moving away from any configurations that provide unauthenticated access to system tools.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.