CVE-2026-56074
PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command calls to bypass approval prompts. Attackers can exploit this by obtaining initial approval for a benign command, then silently exfiltrate API keys and credentials via subsequent shell commands without user consent.
- Score
- CVSS 4.0 6.8 Medium
- Status
- Deferred - disclosure@vulncheck.com
- Published
- 2026-06-18
- Last modified
- 2026-10-26
- Weaknesses
- CWE-863
Affected products
References
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ffp3-3562-8cv3
- https://www.vulncheck.com/advisories/praisonai-tool-approval-cache-bypass-via-coarse-grained-caching
