Is CVE-2026-47410 actively exploited?

No active exploitation of CVE-2026-47410 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-47410 be exploited remotely?

Yes. CVE-2026-47410 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-47410?

CVE-2026-47410 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2026-47410

CRITICAL

CVE-2026-47410

CWE-321Published: July 21, 2026· Updated: Jul 22, 2026

9.8

CVSS v3.1

Official Description

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev-secret-change-me"` when `PLATFORM_JWT_SECRET` is unset. A safety check exists but only fires when `PLATFORM_ENV != "dev"`; the default value of `PLATFORM_ENV` is `"dev"`, so the check is silently bypassed in any deployment that does not explicitly opt out. The attacker reads the literal from this public source file, mints a JWT with arbitrary `sub` and `email` claims, and authenticates as any existing user (including workspace owners and admins). PraisonAI Platform version 0.1.4 patches the issue.

NVD Source

Risk Analysis

PraisonAI Platform uses a hardcoded default JWT signing secret, allowing attackers to forge authentication tokens. By minting their own tokens, attackers can impersonate any user, including administrators. This critical vulnerability provides a trivial path to full platform compromise.

No public exploit is known, and it is not in the KEV catalog. The vulnerability is remotely exploitable.

Recommended Action

Upgrade to PraisonAI Platform version 0.1.4 and ensure a unique, secure secret is configured for JWT signing.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-47410 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.