EUVD-2026-21168
GHSA-4wr3-f4p3-5wjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated request to /api/approval/allow-list endpoint
-
ExploitAdd dangerous tool names to allowlist
-
ExecutionExecApprovalManager auto-approves tool invocations
-
ImpactBypass human-in-the-loop safety mechanism
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Specific exception catching
|
| Exploitation Conditions | PraisonAI versions prior to 4.5.128 with default configuration (no auth_token configured). Remote unauthenticated attacker can modify /api/approval/allow-list endpoint to add dangerous tool names (shell_exec, file_write) to bypass human approval safety mechanism. |
| Impact | Local unauthenticated access to gateway endpoint permits direct allowlist manipulation, bypassing safety controls for dangerous tool execution. CVSS 7.9 reflects high integrity impact and cross-system scope. Critical in shared environments where local attackers exist; lower risk if gateway is network-isolated. Default misconfiguration amplifies exposure. |
| Exploit ScenarioDerived | Attacker with local access sends unauthenticated POST to /api/approval/allow-list, adding 'shell_exec' to allowlist. Subsequent agent requests for shell execution auto-approve without human review, enabling arbitrary command execution. No authentication or code execution required for initial compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Unauthenticated modification of the tool approval allowlist in PraisonAI multi-agent system (versions prior to 4.5.128) enables attackers to bypass human-in-the-loop safety controls by injecting dangerous tool names (shell_exec, file_write) into the allowlist via the /api/approval/allow-list gateway endpoint. The ExecApprovalManager then auto-approves agent invocations of these tools, circumventing the approval mechanism's core security function. Attack requires local access; no public exploit identified at time of analysis. CVSS 7.9 reflects high integrity impact with scope change due to compromised safety boundaries in agent workflows.
RemediationAI
Vendor-released patch: upgrade to PraisonAI version 4.5.128 or later, which enforces authentication requirements on the /api/approval/allow-list endpoint. Immediately configure auth_token parameter in gateway settings to enable access controls prior to upgrading. Review approval allowlists for unauthorized entries (shell_exec, file_write, arbitrary code execution tools) and purge suspicious additions. Audit agent execution logs for auto-approved tool invocations during the vulnerable period. Implement network segmentation to restrict gateway API access to authorized management interfaces only. Full advisory and patch details: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4wr3-f4p3-5wjh
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-396 (Declaration of Catch for Generic Exception) indicates improper exception handling enabling authentication bypass when auth_token remains unconfigured. Default deployment exposes API endpoint without access controls, permitting arbitrary allowlist manipulation. Vulnerability originates from missing authentication enforcement in gateway approval logic affecting PraisonAI cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*.
Know when Praisonai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth_token is configured (the default). By adding dangerous tool names (e.g., shell_exec, file_write) to the allowlist, an attacker can cause the ExecApprovalManager to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce. This vulnerability is fixed in 4.5.128.
Executive ViewAI
PraisonAI versions prior to 4.5.128 contain a high-severity vulnerability allowing attackers with local access to bypass critical safety controls by modifying tool approval settings, potentially enabling unauthorized execution of dangerous operations such as shell commands and file modifications. Organizations using PraisonAI for multi-agent workflows face direct compromise of their human-approval security boundaries, creating risk of unauthorized system access and data manipulation through automated agent actions.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to /api/approval/allow-list endpoint using firewall or API gateway rules to authorized administrators only; (2) Implement comprehensive audit logging and monitoring of all tool approval allowlist modifications with real-time alerting; (3) Enforce principle of least privilege for local access to PraisonAI systems; (4) Manually audit current tool approval allowlist for unexpected or dangerous tool entries (shell_exec, file_write, etc.) and remove any suspicious additions; (5) Consider disabling auto-approval functionality and enforcing explicit human approval for all tool invocations as a temporary control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Exploit-DB