CVE-2026-56832

The PraisonAI multi-agent system (versions 4.5.2 through 4.6.58 ) contains an incorrect authorization vulnerability in its DiscordApproval backend. The praisonai.bots.DiscordApproval component improperly handles tool call approvals by polling the configured Discord channel for any non-bot message...

CVE-2026-56832 PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any...

EUVD-2026-44637

PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments...

Improper Authorization

PraisonAI is vulnerable to Improper Authorization. The vulnerability is due to caching tool approval decisions by tool name instead of validating each invocation and its arguments, allowing attackers to reuse a previously approved tool to perform unauthorized operations with arbitrary parameters,...

CVE-2026-60087

PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with...

PT-2026-60134

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.78 Description PraisonAI caches tool approval decisions using only the tool name, which allows the reuse of an initial approval for subsequent calls with arbitrary arguments. An attacker can obtain approval for ...

Duplicate Advisory: PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ffp3-3562-8cv3. This link is maintained to preserve external references. Original Description PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing...

CVE-2026-56074 PraisonAI - Tool Approval Cache Bypass via Coarse-Grained Caching

PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent executecommand calls to bypass approval prompts. Attackers can exploit this by obtaining initial approval for a benign command, then silently exfiltrate API keys and...

CVE-2026-56074

PraxionAI before 1.5.128 caches tool approval decisions by tool name rather than invocation arguments, enabling bypass of approval prompts for subsequent execute_command calls. Attackers could obtain initial approval for a benign command and then exfiltrate API keys and credentials via later shel...

GHSA-8579-RGG5-PH2M PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals

DiscordApproval accepts unrelated channel messages as dangerous-tool approvals Summary praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. The decision is...

CVE-2026-40149

PraisonAI’s multi-agent system is vulnerable to an unauthenticated modification of the tool approval allowlist via the gateway’s /api/approval/allow-list endpoint (pre-4.5.128). By adding dangerous tool names (e.g., shell_exec, file_write) when no auth_token is configured, an attacker can cause t...

CVE-2026-40149 PraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no authtoken is configured the default. By adding dangerous tool names e.g., shellexec, filewrite to the allowlist, a...