PraisonAI CVE-2026-41496

Requires authenticated access (PR:L) to PraisonAI instance where table_prefix parameter is controllable via external input. Specifically exploitable when: (1) application uses multi-tenant architecture with per-tenant table prefixes derived from user-supplied tenant identifiers, (2) API endpoints accept storage configuration parameters that flow to backend constructors, (3) user-editable configuration files (YAML/JSON) control table_prefix values loaded at runtime, or (4) administrative interfaces allow dynamic backend reconfiguration. Default deployments using hardcoded table_prefix='praison_' are NOT vulnerable. Exploitation is NOT limited by database type-all nine unpatched backends (MySQL, PostgreSQL, Turso, SingleStore, Supabase, SurrealDB, and async variants) are equally exploitable. PostgreSQL backend has additional attack surface via unvalidated schema parameter at line 88. Network access required (AV:N) but low attack complexity (AC:L) once authenticated.

CVSS 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N reflects authenticated network-based exploitation with low complexity enabling high confidentiality and integrity impact. Real-world risk is CONTEXTUAL: default configuration using table_prefix='praison_' is NOT vulnerable; exploitation requires deployments where table_prefix is dynamically set from external input-common in multi-tenant SaaS architectures, API-driven configuration systems, or environments allowing user-modifiable config files. The 52 injection points across nine backends represent significant attack surface, but PR:L (low privilege authentication required) and scope limited to backend data access constrains blast radius. MISSING DATA IMPACTS ASSESSMENT: No EPSS score available to gauge exploitation likelihood; no CISA KEV listing indicates active exploitation not confirmed; vendor advisory confirms patch but public POC availability unknown. Risk is HIGH for multi-tenant deployments with external table_prefix control, MEDIUM for single-tenant with authenticated API access, LOW for hardcoded default configurations. Incomplete initial fix pattern (CVE-2026-40315) suggests systematic code review debt-defenders should verify all backends are upgraded to patched versions.

Authenticated attacker in multi-tenant PraisonAI deployment modifies API request or configuration file to set table_prefix to "praison_'; DROP TABLE users; --". Application passes unsanitized prefix into f-string SQL in postgres.py line 89 during conversation store initialization. Resulting query CREATE TABLE praison_'; DROP TABLE users; --_conversations executes SQL injection payload, dropping the users table and potentially escalating to full database compromise through subsequent injections. No public POC confirmed but exploitation pattern identical to previously fixed CVE-2026-40315.