CVE-2026-40149 Details
Description
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth_token is configured (the default). By adding dangerous tool names (e.g., shell_exec, file_write) to the allowlist, an attacker can cause the ExecApprovalManager to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce. This vulnerability is fixed in 4.5.128.
A vulnerability in PraisonAI versions prior to 4.5.128 allows unauthenticated users to modify the tool approval allowlist through the gateway's /api/approval/allow-list endpoint. This issue arises when no auth_token is configured, which is the default setting. By adding names of dangerous tools, such as shell_exec and file_write, to the allowlist, an attacker can manipulate the ExecApprovalManager to automatically approve future uses of those tools by agents. This bypasses the intended human review process, creating a significant safety risk.
Users are advised to configure an auth_token for the approval endpoints to prevent unauthorized modifications. Alternatively, allowlist additions can be restricted to known safe tools.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4wr3-f4p3-5wjh | CISA-ADP | ExploitVendor Advisory |
| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4wr3-f4p3-5wjh | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-396 | Declaration of Catch for Generic Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| praison praisonai | < 4.5.128 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 13, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | New CVE Received | [email protected] |