What is the CVSS score of CVE-2026-40313?

CVE-2026-40313 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Docker are affected by CVE-2026-40313?

PraisonAI versions 4.5.139 and below leak GitHub Actions credentials (GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN) in publicly accessible workflow artifacts, enabling unauthenticated attackers to…. A patch is available.

How to fix or mitigate CVE-2026-40313?

Within 24 hours: Audit all PraisonAI deployments and identify instances running version 4.5.139 or below; immediately rotate all GitHub tokens and Actions runtime tokens. Within 7 days: upgrade all affected PraisonAI instances to version 4.5.140 or later and verify persist-credentials is disabled in actions/checkout configurations. Within 30 days: implement credential scanning in CI/CD pipelines, audit artifact retention policies, and review access logs for unauthorized token extraction from public repositories.

Docker CVE-2026-40313

EUVD-2026-22214 CRITICAL

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-04-14 GitHub_M

Information Disclosure Docker Praisonai Mervinpraison

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 20, 2026 - 17:39 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.5.140

Analysis Generated

Apr 14, 2026 - 04:11 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 04:00 euvd

EUVD-2026-22214

Analysis Generated

Apr 14, 2026 - 04:00 vuln.today

CVE Published

Apr 14, 2026 - 03:10 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the GITHUB_TOKEN (and sometimes ACTIONS_RUNTIME_TOKEN) into the .git/config file for persistence, and if any subsequent workflow step uploads artifacts (build outputs, logs, test results, etc.), these tokens can be inadvertently included. Since PraisonAI is a public repository, any user with read access can download these artifacts and extract the leaked tokens, potentially enabling an attacker to push malicious code, poison releases and PyPI/Docker packages, steal repository secrets, and execute a full supply chain compromise affecting all downstream users. The issue spans numerous workflow and action files across .github/workflows/ and .github/actions/. This issue has been fixed in version 4.5.140.

AnalysisAI

GitHub Actions credential leakage in PraisonAI through ArtiPACKED attack exposes GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN in workflow artifacts. Versions 4.5.139 and below persist credentials in .git/config via actions/checkout without disabling persist-credentials, allowing any user with read access to public repository artifacts to extract tokens and compromise the supply chain. CVSS 9.1 (Critical) with network-accessible, unauthenticated attack vector. EPSS data not provided; no confirmed active exploitation (KEV status not indicated), but attack technique is publicly documented by Palo Alto Unit42 and widely reported. Vendor-released patch available in version 4.5.140.

Technical ContextAI

The ArtiPACKED attack exploits a default behavior in GitHub's actions/checkout action where authentication tokens (GITHUB_TOKEN, ACTIONS_RUNTIME_TOKEN) are written to .git/config for repository persistence. When workflows subsequently upload artifacts-common in CI/CD pipelines for build outputs, test results, or logs-these config files containing plaintext credentials are inadvertently packaged. GitHub Actions artifacts in public repositories are readable by any authenticated GitHub user, creating a credential disclosure vector. The vulnerability (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) stems from trusting the default checkout behavior without explicitly setting persist-credentials: false. PraisonAI's multi-agent teams system uses extensive GitHub Actions workflows across .github/workflows/ and .github/actions/ directories, multiplying the exposure surface. The affected product is specifically cpe:2.3:a:mervinpraison:praisonai versions up to and including 4.5.139.

RemediationAI

Upgrade immediately to PraisonAI version 4.5.140, which remediates the credential persistence issue across all affected workflows. The patch explicitly sets persist-credentials: false in actions/checkout steps to prevent token writing to .git/config. For users unable to upgrade immediately, implement a temporary workaround by manually editing all .github/workflows/*.yml and .github/actions/*/action.yml files to add 'persist-credentials: false' to every actions/checkout invocation, then audit and purge existing workflow artifacts that may contain leaked credentials. Rotate any GITHUB_TOKEN or repository secrets that may have been exposed in historical artifacts. Consult the GitHub security advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-3959-6v5q-45q2 and review Palo Alto's technical analysis at https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens for detection guidance.