EUVD-2026-44637
GHSA-r3xw-gcpr-rf26
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and required user interaction reflect session-scope exploitation with mandatory initial approval; PR:N because no OS account privileges are needed to influence agent arguments; I:H for arbitrary file write capability.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in the same session.
AnalysisAI
PraisonAI's tool approval caching mechanism in versions before 1.6.78 allows an attacker who influences an AI agent's behavior within a session to bypass human-in-the-loop oversight by reusing a single user-granted approval across tool calls with entirely different, unreviewed arguments. The flaw (CWE-863: Incorrect Authorization) directly undermines the security boundary that tool approval is designed to enforce, enabling arbitrary file write operations after approval of a benign operation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog; however, the CVSS 4.0 score of 6.9 with high integrity impact reflects meaningful risk for any deployment relying on tool approval as a control.
Technical ContextAI
PraisonAI (CPE: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*) is a multi-agent AI orchestration framework that implements a human-in-the-loop tool approval model - when an agent requests a tool execution, the user must explicitly authorize it before it proceeds. The root cause is CWE-863 (Incorrect Authorization): the approval cache stores decisions keyed solely on the tool name, without incorporating the arguments supplied to that tool. Once a name-based cache entry exists, the authorization check is skipped on all future invocations of that tool within the session, regardless of what arguments are passed. This architectural flaw means the approval mechanism operates as a one-time name whitelist rather than a per-invocation argument-aware gate, turning a security control into a single-use bypass opportunity.
RemediationAI
Upgrade PraisonAI to version 1.6.78 or later, which corrects the approval cache to evaluate tool name and argument payload together, preventing approval reuse across distinct invocations. The vendor advisory is at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29r9-67vg-qj56. If an immediate upgrade is not feasible, operators should disable tool approval caching entirely and require explicit per-call user confirmation - this eliminates the bypass at the cost of increased user interaction overhead in long agent sessions. As a secondary compensating control, restrict the set of tools exposed to the agent to those that cannot perform destructive or sensitive operations (e.g., file writes, network calls), reducing the blast radius even if an approval is reused with unintended arguments. Note that neither workaround addresses the root CWE-863 flaw; only patching to 1.6.78 does.
PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today