CVE-2026-56074: PraisonAI Tool Approval Cache Bypass Allows Credential Exfiltration

Technical summary

The vulnerability stems from insufficient cache granularity in PraisonAI's tool approval mechanism. The caching logic indexes approval decisions by tool name alone (CWE-863: Incorrect Authorization), failing to incorporate invocation-specific parameters into the cache key. When a user approves execution of execute_command with benign arguments, the approval is cached. Subsequent calls to the same tool with different—potentially malicious—arguments are matched against the cached decision and bypass the approval prompt entirely. An unauthenticated local attacker with user interaction can chain this with information disclosure (C:H rating in CVSS vector) to exfiltrate sensitive credentials that may be accessible within the application's runtime environment.

Business impact

Organizations deploying PraisonAI for autonomous tool execution face credential compromise risk. An attacker who gains local access and can interact with the application can weaponize a single user approval to steal API keys, database passwords, or other secrets embedded in environment variables or application memory. This is particularly acute if PraisonAI is used in development environments or CI/CD pipelines where high-privilege credentials are routinely available. The impact escalates if compromised credentials grant access to production systems, cloud infrastructure, or third-party services.

Affected systems

PraisonAI releases prior to version 1.5.128 are affected. The vulnerability requires local access and user interaction (the initial approval must be granted by a user), so remote, unauthenticated exploitation over a network is not possible. Development teams, data scientists, and automation engineers using older PraisonAI versions in local or on-premises environments are most exposed.

Exploitability

Exploitation requires two conditions: (1) local code execution or shell access to the host running PraisonAI, and (2) a user who is willing to approve a seemingly benign tool command. The attacker's role is social engineering—convincing a user that a particular command is safe. Once initial approval is obtained, the attacker can execute arbitrary follow-up commands using the execute_command tool without further prompts. No network connectivity, special privileges, or zero-day techniques are needed beyond the initial local presence and user interaction. The CVSS score of 5.5 reflects this local, user-interaction-dependent attack surface.

Remediation

Upgrade PraisonAI to version 1.5.128 or later. This release corrects the cache key to include invocation arguments, ensuring that each unique command—even if using the same tool—requires fresh approval. Review and revoke any API keys or credentials that may have been active during the use of vulnerable versions in sensitive environments. If upgrading is not immediately possible, restrict the execute_command tool's permissions or disable it entirely in high-risk deployments, and monitor for suspicious shell command patterns in audit logs.

Patch guidance

Apply version 1.5.128 or any subsequent release as soon as feasible, prioritizing development and staging environments first. Verify patch applicability in your environment by confirming the current installed version with `--version` or equivalent mechanism. The fix involves changes to the tool approval caching logic and does not require data migration or configuration changes. Plan the upgrade during a maintenance window if PraisonAI is integrated into critical automation pipelines. After patching, test that approval prompts are again shown for each unique command invocation, not just per tool name.

Detection guidance

Monitor audit or debug logs for repeated execute_command executions using the same tool name but different arguments in quick succession, especially if only the first invocation shows an approval prompt. Look for shell command patterns indicative of credential theft: calls to `env`, `printenv`, `cat ~/.aws/credentials`, `cat ~/.ssh/id_rsa`, or similar information-gathering commands. If PraisonAI logs approval decisions, correlate logged approvals against subsequent command arguments to spot mismatches. Implement filesystem and network monitoring to flag unexpected data exfiltration from the PraisonAI host, such as outbound connections to unknown IP addresses immediately following tool executions.

Why prioritize this

This vulnerability is prioritized as medium-severity because it directly enables credential exfiltration in a local context. While it requires user interaction and local access, the consequence—silent theft of sensitive credentials—can have organization-wide security impact if those credentials are high-value (cloud API keys, database passwords). Teams running PraisonAI in any environment where credentials are accessible should treat this as a near-term patch candidate. The lack of CISA KEV listing does not diminish the real-world risk in environments where PraisonAI is actively used for tool automation.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector: Local (the attacker must be on the same system); Attack Complexity: Low (no special conditions needed beyond initial local presence); Privileges Required: None (any local user can trigger the flaw); User Interaction: Required (an initial approval prompt must be satisfied); Scope: Unchanged (impact is limited to the local system's credentials); Confidentiality: High (API keys and secrets can be fully exposed); Integrity: None (the vulnerability does not alter data); Availability: None (no denial-of-service component). The score appropriately captures a significant but bounded threat—serious for environments where credentials are at stake, but geographically limited to local exploitation.

Frequently asked questions