ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-56074

PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands

Published Jul 13, 2026 · catalog updated Oct 16, 2026 · PraisonAI: Coarse-Grained Tool Approval

Check if you run it

No confirmed exploitation is on record for CVE-2026-56074. EPSS is 0.18%. Act only if a listed version of PraisonAI: Coarse-Grained Tool Approval is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (PraisonAI: Coarse-Grained Tool Approval).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.18%
Remediation
Advisory link
Affected products
PyPI praisonaiagents

## Summary The approval system in PraisonAI Agents caches tool approval decisions by tool name only, not by invocation arguments. Once a user approves for any command (e.g., ), all subsequent calls in that execution context bypass the approval prompt entirely. Combined with passing all process environment variables to subprocesses, this allows an LLM agent (potentially via prompt injection) to silently exfiltrate API keys and credentials without further user consent. ## Details The decorator in checks approval status by tool name only: The function in stores only the tool name string: The approval context is never cleared during agent execution — exists ( ) but is never called in the agent's tool execution path ( ). Meanwhile, the UI at misleads the user: The UI displays the specific command arguments (lines 81-85), creating a reasonable expectation that the user is approving only that specific invocation. Additionally, passes the full process environment to every subprocess: There is no command filtering, blocklist, or environment variable sanitization in the shell tools module. ## PoC ## Impact - **Secret exfiltration**: An LLM agent (or one subjected to prompt injection) can dump all process environment variables after a single benign command approval. Common secrets include , , , and any other credentials passed via environment. - **Misleading consent UI**: The console prompt displays specific arguments and uses language ("this tool") that implies per-invocation consent, but the system grants session-wide blanket approval. - **No expiration or scope**: The approval cache uses a that persists for the entire agent execution context with no timeout, no command-count limit, and no clearing between tool calls. - **No environment filtering**: passes every environment variable to subprocesses without filtering sensitive patterns. ## Recommended Fix 1. **Per-invocation approval for critical tools** — store a hash of instead of just , or require re-approval for each invo

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI praisonaiagents0 → 4.5.128

How to fix CVE-2026-56074

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-56074. EPSS is 0.18%. Act only if a listed version of PraisonAI: Coarse-Grained Tool Approval is installed.

Which versions are affected?

Compare what you have installed with 0 → 4.5.128. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.18%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 13, 2026 · GitHub Advisory Database

    Detected

    ## Summary The approval system in PraisonAI Agents caches tool approval decisions by tool name only, not by invocation arguments. Once a user approves for any command (e.g., ), all subsequent calls in that execution context bypass the approval prompt entirely. Combined with passing all process environment variables to subprocesses, this allows an LLM agent (potentially via prompt injection) to sil

  2. Oct 13, 2026 · GitHub Advisory Database

    Fix available

    praisonaiagents fixed in 4.5.128

  3. Oct 13, 2026 · GitHub Advisory Database

    Fix available

    praisonaiagents fixed in 4.5.128

  4. Oct 13, 2026 · GitHub Advisory Database

    Updated

    ## Summary The approval system in PraisonAI Agents caches tool approval decisions by tool name only, not by invocation arguments. Once a user approves for any command (e.g., ), all subsequent calls in that execution context bypass the approval prompt entirely. Combined with passing all process environment variables to subprocesses, this allows an LLM agent (potentially via prompt injection) to sil

  5. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ## Summary The approval system in PraisonAI Agents caches tool approval decisions by tool name only, not by invocation arguments. Once a user approves for any command (e.g., ), all subsequent calls in that execution context bypass the approval prompt entirely. Combined with passing all process environment variables to subprocesses, this allows an LLM agent (potentially via prompt injection) to sil

Sources

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.