What is the CVSS score of CVE-2026-40313?

CVE-2026-40313 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Docker are affected by CVE-2026-40313?

PraisonAI versions 4.5.139 and below leak GitHub Actions credentials (GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN) in publicly accessible workflow artifacts, enabling unauthenticated attackers to…. A patch is available.

How to fix or mitigate CVE-2026-40313?

Within 24 hours: Audit all PraisonAI deployments and identify instances running version 4.5.139 or below; immediately rotate all GitHub tokens and Actions runtime tokens. Within 7 days: upgrade all affected PraisonAI instances to version 4.5.140 or later and verify persist-credentials is disabled in actions/checkout configurations. Within 30 days: implement credential scanning in CI/CD pipelines, audit artifact retention policies, and review access logs for unauthorized token extraction from public repositories.

Docker CVE-2026-40313

EUVD-2026-22214 CRITICAL

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-04-14 GitHub_M

Information Disclosure Docker

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 20, 2026 - 17:39 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.5.140

Analysis Generated

Apr 14, 2026 - 04:11 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 04:00 euvd

EUVD-2026-22214

Analysis Generated

Apr 14, 2026 - 04:00 vuln.today

CVE Published

Apr 14, 2026 - 03:10 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the GITHUB_TOKEN (and sometimes ACTIONS_RUNTIME_TOKEN) into the .git/config file for persistence, and if any subsequent workflow step uploads artifacts (build outputs, logs, test results, etc.), these tokens can be inadvertently included. Since PraisonAI is a public repository, any user with read access can download these artifacts and extract the leaked tokens, potentially enabling an attacker to push malicious code, poison releases and PyPI/Docker packages, steal repository secrets, and execute a full supply chain compromise affecting all downstream users. The issue spans numerous workflow and action files across .github/workflows/ and .github/actions/. This issue has been fixed in version 4.5.140.

AnalysisAI

GitHub Actions credential leakage in PraisonAI through ArtiPACKED attack exposes GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN in workflow artifacts. Versions 4.5.139 and below persist credentials in .git/config via actions/checkout without disabling persist-credentials, allowing any user with read access to public repository artifacts to extract tokens and compromise the supply chain. CVSS 9.1 (Critical) with network-accessible, unauthenticated attack vector. EPSS data not provided; no confirmed active exploitation (KEV status not indicated), but attack technique is publicly documented by Palo Alto Unit42 and widely reported. Vendor-released patch available in version 4.5.140.

Technical ContextAI

The ArtiPACKED attack exploits a default behavior in GitHub's actions/checkout action where authentication tokens (GITHUB_TOKEN, ACTIONS_RUNTIME_TOKEN) are written to .git/config for repository persistence. When workflows subsequently upload artifacts-common in CI/CD pipelines for build outputs, test results, or logs-these config files containing plaintext credentials are inadvertently packaged. GitHub Actions artifacts in public repositories are readable by any authenticated GitHub user, creating a credential disclosure vector. The vulnerability (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) stems from trusting the default checkout behavior without explicitly setting persist-credentials: false. PraisonAI's multi-agent teams system uses extensive GitHub Actions workflows across .github/workflows/ and .github/actions/ directories, multiplying the exposure surface. The affected product is specifically cpe:2.3:a:mervinpraison:praisonai versions up to and including 4.5.139.

RemediationAI

Upgrade immediately to PraisonAI version 4.5.140, which remediates the credential persistence issue across all affected workflows. The patch explicitly sets persist-credentials: false in actions/checkout steps to prevent token writing to .git/config. For users unable to upgrade immediately, implement a temporary workaround by manually editing all .github/workflows/*.yml and .github/actions/*/action.yml files to add 'persist-credentials: false' to every actions/checkout invocation, then audit and purge existing workflow artifacts that may contain leaked credentials. Rotate any GITHUB_TOKEN or repository secrets that may have been exposed in historical artifacts. Consult the GitHub security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-3959-6v5q-45q2 and review Palo Alto's technical analysis at https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens for detection guidance.