Description Summary:
PraisonAI contains an unsafe reflection vulnerability via externally controlled tool names, allowing unauthenticated attackers to invoke unintended application callables.

Executive Summary:
An unsafe reflection vulnerability in MervinPraison PraisonAI and praisonaiagents allows unauthenticated remote attackers to invoke arbitrary application callables, leading to potential integrity compromise and partial data access.

Vulnerability Details

CVE-ID: CVE-2026-44339

Affected Software: MervinPraison PraisonAI and praisonaiagents

Affected Versions: praisonaiagents < 1.6.37, praisonai < 4.6.37

Vulnerability: This is an unsafe reflection flaw classified as CWE-470, where externally controlled input selects classes or code. The application resolves unresolved tool names against module globals and main when default permissions do not reject undeclared tool names, requiring no authentication.

Business Impact

The high CVSS score of 8.6 reflects significant potential for unauthorized control execution and data tampering. A successful exploit could allow attackers to execute unintended functions within the application context, resulting in system compromise, unauthorized data modification, and potential operational disruption.

Remediation Plan

Immediate Action: Update praisonai to version 4.6.37 and praisonaiagents to version 1.6.37 or later via PyPI.

Proactive Monitoring: Monitor application logs for unusual tool invocation patterns, unexpected module calls, or unauthorized interaction attempts with internal agent functions.

Compensating Controls: Implement strict input validation rules at the network perimeter or application gateway to inspect tool-call parameters and reject unexpected or malformed inputs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from permissive tool handling that enables unauthenticated code path selection.

Analyst Recommendation

Given the high severity score and the availability of a proof-of-concept, organizations must prioritize patching immediately. Administrators should upgrade both praisonai and praisonaiagents to their respective fixed versions to eliminate the reflection vector and secure the agent environment.

Description Summary:
PraisonAI ships a legacy Flask API server with authentication disabled by default, allowing unauthenticated callers to trigger agent workflows.

Executive Summary:
A missing authentication vulnerability in PraisonAI affects versions 2.5.6 through 4.6.33, exposing multi-agent workflows to unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-44338

Affected Software: MervinPraison PraisonAI

Affected Versions: MervinPraison PraisonAI: >= 2.5.6, < 4.6.34

Vulnerability: This vulnerability is classified as a missing authentication flaw (CWE-306) residing in the legacy Flask API server, which allows unauthenticated remote attackers to access restricted endpoints and trigger workflows via the chat interface.

Business Impact

A successful exploit allows unauthorized users to interact with deployed multi-agent workflows, potentially leading to unauthorized data exposure, manipulation of agent actions, and resource exhaustion. With a CVSS score of 7.3, this high severity issue poses a significant risk to organizational operations and confidentiality if the API is exposed to untrusted networks.

Remediation Plan

Immediate Action: Update PraisonAI to version 4.6.34 or later to resolve the missing authentication issue in the Flask API server.

Proactive Monitoring: Monitor API access logs for unusual inbound requests targeting the chat and agent endpoints, especially those originating from external or unauthenticated IP addresses.

Compensating Controls: Implement network segmentation or deploy a Web Application Firewall rule to restrict access to the legacy Flask API server until updates can be applied.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub and a Nuclei detection template is available.

Analyst Notes: As of May 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of unauthenticated network vectors significantly lowers the barrier for attackers.

Analyst Recommendation

Administrators must treat this vulnerability with high priority due to the presence of public proof-of-concept code and unauthenticated remote vector access. Immediate application of the 4.6.34 patch is required to secure the environment against unauthorized workflow execution.

Description Summary:
PraisonAI's MCP server fails to sanitize file paths in tool arguments, allowing unauthenticated attackers to perform arbitrary file writes and achieve code execution.

Executive Summary:
An unauthenticated directory traversal vulnerability in PraisonAI permits attackers to overwrite critical system files, leading to full system compromise via arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-44336

Affected Software: PraisonAI PraisonAI

Affected Versions: Prior to 4.6.34

Vulnerability: The MCP server fails to validate input paths, allowing an attacker to use directory traversal sequences (e.g., ../../) to write files outside the intended directory. This permits the dropping of malicious Python .pth files into site-packages, resulting in arbitrary code execution in subsequent Python processes.

Business Impact

Successful exploitation allows an attacker to gain persistent, unauthorized access to the host server. This poses a significant risk of data theft, configuration tampering, and full system takeover. The 9.6 CVSS score underscores the severity of this vulnerability, necessitating urgent intervention to prevent exploitation.

Remediation Plan

Immediate Action: Update the PraisonAI installation to version 4.6.34 immediately to enforce strict path validation and containment checks.

Proactive Monitoring: Review file integrity logs for unauthorized modifications in Python site-packages or unexpected file creation within the application's base directory.

Compensating Controls: Restrict the service account running the PraisonAI process to the minimum necessary filesystem permissions to limit the scope of potential file overwrites.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a severe risk of persistence and code execution. Security teams must treat this as a high-priority update. Ensure all instances are patched to version 4.6.34 and verify that the service is running with the least privilege required to perform its functions.

Description Summary:
PraisonAI contains a logical flaw in its URL checking mechanism that allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) attacks.

Executive Summary:
A logical flaw in PraisonAI's URL validation logic exposes the application to Server-Side Request Forgery (SSRF), potentially allowing unauthorized internal network access.

Vulnerability Details

CVE-ID: CVE-2026-44335

Affected Software: PraisonAI PraisonAI

Affected Versions: Prior to 1.6.32

Vulnerability: The application's URL checking logic is insufficient, allowing an unauthenticated attacker to bypass security filters. This enables the application to be used as a proxy to send requests to internal resources that are otherwise inaccessible from the public internet.

Business Impact

SSRF vulnerabilities can lead to the exposure of internal-only services, metadata endpoints, and sensitive configuration interfaces. By leveraging the internal trust of the server, an attacker can bypass traditional network defenses. The 9.8 CVSS score reflects the high potential for lateral movement and internal reconnaissance within the organization's infrastructure.

Remediation Plan

Immediate Action: Upgrade to PraisonAI version 1.6.32 or later to rectify the URL validation logic flaws.

Proactive Monitoring: Monitor egress traffic from the server for requests directed toward internal IP ranges or sensitive internal services.

Compensating Controls: Implement strict network segmentation and egress filtering to prevent the application server from initiating connections to sensitive internal network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for internal network exposure, this vulnerability requires immediate attention. Administrators must apply the patch version 1.6.32 to prevent SSRF-based attacks that could lead to broader infrastructure compromise.

Description Summary:
PraisonAI fails to validate commands in parse_mcp_command(), allowing unauthenticated attackers to execute arbitrary system commands via subprocesses.

Executive Summary:
A critical vulnerability in PraisonAI allows unauthenticated remote attackers to achieve arbitrary code execution by exploiting improper command and argument validation.

Vulnerability Details

CVE-ID: CVE-2026-41497

Affected Software: PraisonAI PraisonAI

Affected Versions: Prior to 4.6.9

Vulnerability: The application lacks an allowlist or argument validation for the parse_mcp_command() function, enabling the execution of arbitrary system binaries such as bash or python. This flaw allows an unauthenticated attacker to inject malicious code via subprocess execution.

Business Impact

The exploitation of this vulnerability grants attackers full control over the underlying host system, leading to complete data exfiltration, service disruption, and potential lateral movement within the network. With a CVSS score of 9.8, this represents a critical risk that could result in total system compromise and severe reputational damage.

Remediation Plan

Immediate Action: Upgrade PraisonAI to version 4.6.9 or later to implement necessary command allowlisting and argument validation.

Proactive Monitoring: Inspect system process logs for anomalous subprocess invocations, specifically those originating from the application user context involving shell execution flags.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input filtering to block requests containing suspicious command-line sequences or shell-related characters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this remote code execution vulnerability, immediate patching is required. Organizations should prioritize updating their PraisonAI deployment to version 4.6.9 to eliminate the underlying command injection vector and secure the environment against potential unauthorized access.

Description Summary:
Multiple SQL injection vulnerabilities exist in PraisonAI due to unvalidated input passed directly into f-string SQL statements across nine database backends.

Executive Summary:
PraisonAI is vulnerable to multiple SQL injection flaws affecting numerous database backends, allowing authenticated attackers to compromise database confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-41496

Affected Software: MervinPraison PraisonAI

Affected Versions: praisonai < 4.6.9, praisonaiagents < 1.6.9

Vulnerability: This issue is an SQL Injection flaw categorized under CWE-89, where database parameters and table prefixes are passed directly into f-string SQL statements without proper neutralization, requiring low privileges to exploit.

Business Impact

A successful exploit allows attackers to manipulate database queries, potentially leading to unauthorized data exposure, data modification, or deletion across connected databases. With a CVSS score of 8.1, the high severity classification reflects the severe potential impact on data confidentiality and integrity, threatening organizational operations and trust.

Remediation Plan

Immediate Action: Update the affected packages to praisonai version 4.6.9 and praisonaiagents version 1.6.9 or later.

Proactive Monitoring: Monitor database query logs for unusual query patterns, syntax errors, or unexpected administrative commands originating from the application.

Compensating Controls: Deploy a Web Application Firewall with SQL injection inspection rules to detect and block malicious payloads directed at the application endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from widespread improper neutralization in database backend handlers.

Analyst Recommendation

Organizations utilizing PraisonAI must treat this high severity vulnerability with urgency. Administrators should apply the recommended package updates immediately to eliminate the underlying SQL injection vectors and protect database assets from compromise.

Description Summary:
A reachable assertion in the Kyverno policy engine allows authenticated users to crash the background controller and block resource operations via malicious Policy or ClusterPolicy definitions.

Executive Summary:
A vulnerability in the Kyverno policy engine allows authenticated users with policy creation permissions to trigger a persistent denial of service that impacts cluster-wide resource operations.

Vulnerability Details

CVE-ID: CVE-2026-41485

Affected Software: Kyverno Kyverno

Affected Versions: < 1.16.4, >= 1.17.0-rc1, < 1.17.2

Vulnerability: This vulnerability, categorized as a reachable assertion (CWE-617), stems from an unchecked type assertion in the legacy engine's forEach mutation handler. Any user possessing the privileges to create a Policy or ClusterPolicy can trigger this flaw to force the admission controller into a persistent CrashLoopBackOff.

Business Impact

The successful exploitation of this vulnerability results in a complete denial of service for the admission controller, preventing the cluster from processing resource operations. Given the CVSS score of 7.7, the impact is high because it disrupts critical infrastructure management and automated policy enforcement within cloud native environments.

Remediation Plan

Immediate Action: Upgrade the Kyverno deployment to version 1.16.4 or 1.17.2 to incorporate the necessary patches for the legacy engine.

Proactive Monitoring: Monitor cluster logs for repeated CrashLoopBackOff events related to the Kyverno controller and audit the creation of new Policy or ClusterPolicy resources for suspicious configurations.

Compensating Controls: Restrict permissions for creating or updating Policy and ClusterPolicy resources to highly trusted administrative roles to prevent unauthorized users from triggering the crash.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is specific to the legacy engine, and users utilizing CEL-based policies remain unaffected.

Analyst Recommendation

Organizations utilizing Kyverno must prioritize this update to maintain cluster stability and availability. By upgrading to the patched versions, administrators effectively neutralize the risk of unauthorized users inducing a persistent denial of service condition. Immediate deployment of the provided patches is strongly advised to ensure the resilience of the cloud native control plane.

Description Summary:
OpenClaw before 2026.3.31 allows unauthenticated remote attackers to cause resource exhaustion by sending malicious MS Teams webhook payloads that are parsed before JWT validation occurs.

Executive Summary:
A vulnerability in OpenClaw allows unauthenticated attackers to trigger a denial of service through resource exhaustion via manipulated MS Teams webhook requests.

Vulnerability Details

CVE-ID: CVE-2026-41405

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.3.31

Vulnerability: The application incorrectly orders its request processing, parsing MS Teams webhook bodies prior to performing necessary JWT authentication checks. This flaw allows unauthenticated remote attackers to send specially crafted payloads that exhaust server resources.

Business Impact

The exploitation of this vulnerability can lead to significant denial of service, rendering the application unavailable to legitimate users. With a CVSS score of 7.5, the risk is elevated because the attack is network-exploitable and requires no authentication, potentially resulting in operational disruption and service downtime for organizations relying on this integration.

Remediation Plan

Immediate Action: Update the OpenClaw package to version 2026.3.31 or later, as provided in the npm repository, to ensure proper authentication order is enforced.

Proactive Monitoring: Monitor server CPU and memory utilization logs for sudden, anomalous spikes associated with incoming webhook traffic.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway to perform request validation and rate limiting before the traffic reaches the vulnerable application logic.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication, making it a highly attractive target for automated scanning and exploitation.

Analyst Recommendation

Given the ease of exploitation, this vulnerability poses a clear risk to service availability. Organizations should prioritize updating their instances to the patched version immediately to prevent potential denial of service attacks. If an immediate update is not feasible, implement strict rate limiting and filtering on the webhook endpoint to mitigate the impact.

Description Summary:
Kyverno contains an SSRF vulnerability in the apiCall feature where the admission controller service account token is leaked to unauthorized servers, potentially leading to full cluster compromise.

Executive Summary:
A critical security flaw in Kyverno allows authenticated users to leak sensitive service account tokens via SSRF, resulting in a risk of full Kubernetes cluster compromise.

Vulnerability Details

CVE-ID: CVE-2026-41323

Affected Software: Kyverno Kyverno

Affected Versions: < 1.16.4, 1.17.0-rc1 to < 1.17.2-rc1

Vulnerability: This vulnerability involves a combination of Server-Side Request Forgery (CWE-918) and sensitive information exposure (CWE-200). An authenticated user with sufficient permissions to define a ClusterPolicy can trigger outgoing HTTP requests to attacker-controlled endpoints, causing the admission controller to automatically leak its ServiceAccount token.

Business Impact

The exploitation of this vulnerability poses a severe threat to containerized environments. Because the leaked ServiceAccount token possesses high-level permissions, including the ability to patch webhook configurations, an attacker could escalate privileges to achieve full control over the Kubernetes cluster. With a CVSS score of 8.1, this represents a High severity risk that could lead to unauthorized data access, lateral movement, and total system compromise.

Remediation Plan

Immediate Action: Upgrade to version 1.16.4, 1.17.2-rc1, or 1.18.0-rc1 immediately to include the necessary service URL validation logic.

Proactive Monitoring: Review cluster audit logs for unusual egress traffic originating from the Kyverno admission controller pod to unknown or external IP addresses.

Compensating Controls: Implement network policies that restrict the egress traffic of the Kyverno admission controller namespace to prevent unauthorized connections to external servers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous due to the automatic nature of the token exposure once an attacker creates a malicious ClusterPolicy.

Analyst Recommendation

Given the potential for full cluster compromise, organizations utilizing Kyverno must prioritize this update. Administrators should verify their current deployment version and apply the vendor-provided patches as soon as possible to prevent the exposure of sensitive admission controller tokens.

Description Summary:
Kyverno contains an incorrect authorization vulnerability allowing namespace administrators to read ConfigMaps from any namespace via the ConfigMap context loader.

Executive Summary:
A critical authorization bypass in the Kyverno policy engine allows authenticated namespace administrators to escalate privileges and access sensitive data across Kubernetes namespaces.

Vulnerability Details

CVE-ID: CVE-2026-41068

Affected Software: Kyverno Kyverno

Affected Versions: < 1.17.2

Vulnerability: This vulnerability is an instance of CWE-863, where the ConfigMap context loader fails to validate the namespace field. An authenticated user with namespace-level permissions can leverage Kyverno's privileged service account to perform unauthorized reads of ConfigMaps in any namespace within the cluster.

Business Impact

The ability to access ConfigMaps across namespaces constitutes a complete RBAC bypass in multi-tenant Kubernetes environments. Given the CVSS score of 7.7, this flaw poses a high risk as it enables the exposure of sensitive configuration data, including API keys, tokens, or credentials stored in ConfigMaps, leading to potential lateral movement or full cluster compromise.

Remediation Plan

Immediate Action: Upgrade the Kyverno deployment to version 1.17.2 or later to apply the necessary namespace validation logic.

Proactive Monitoring: Audit Kubernetes audit logs for unusual access patterns to ConfigMaps initiated by the Kyverno service account or unexpected cross-namespace requests.

Compensating Controls: Implement strict Kubernetes Network Policies to restrict traffic to and from the Kyverno pod, and consider using admission controllers to enforce tighter RBAC restrictions on namespace administrators.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly impactful due to the inherent trust placed in the Kyverno service account during policy execution.

Analyst Recommendation

Given the potential for complete RBAC bypass in multi-tenant clusters, this vulnerability represents a significant security risk to cloud native infrastructure. Administrators must prioritize updating Kyverno to version 1.17.2 immediately to remediate this authorization flaw and prevent unauthorized access to sensitive cluster secrets.

Description Summary:
Kyverno policy engine versions prior to 1.16.4 are vulnerable to a confused deputy attack where the service account token is sent to attacker-controlled endpoints via the apiCall servicecall helper.

Executive Summary:
A high-severity vulnerability in the Kyverno policy engine allows authenticated users to leak sensitive service account tokens to external, attacker-controlled endpoints.

Vulnerability Details

CVE-ID: CVE-2026-40868

Affected Software: Kyverno Kyverno

Affected Versions: < 1.16.4

Vulnerability: This is an insecure information storage issue (CWE-922) where the apiCall servicecall helper implicitly injects the Kyverno controller service account token into requests. Because the service URL is policy-controlled, an attacker with the ability to define ClusterPolicies can redirect this token to an arbitrary remote endpoint.

Business Impact

Successful exploitation allows an attacker to obtain the Kyverno controller service account token, which typically possesses high-level cluster privileges. Compromise of this token enables unauthorized access to the Kubernetes API, potentially leading to full cluster compromise, data exfiltration, or unauthorized configuration changes. With a CVSS score of 8.1, this vulnerability represents a significant risk to the integrity and confidentiality of cloud-native environments.

Remediation Plan

Immediate Action: Upgrade to Kyverno version 1.16.4 or later to ensure the service account token is no longer implicitly included in policy-controlled API calls.

Proactive Monitoring: Review existing ClusterPolicies for suspicious apiCall configurations and monitor egress traffic logs for unexpected connections originating from the Kyverno controller pod.

Compensating Controls: Implement strict NetworkPolicies to restrict the Kyverno controller pod from initiating outbound connections to untrusted or external IP addresses.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the potential for privilege escalation within the Kubernetes control plane.

Analyst Recommendation

The ability for a policy-controlled parameter to leak high-privilege credentials makes this vulnerability a critical concern for platform engineering teams. Administrators must prioritize updating the Kyverno controller immediately and auditing current ClusterPolicies to ensure no malicious or misconfigured policies are present in the cluster.

Description Summary:
The PraisonAI workflow engine is vulnerable to arbitrary command and code execution via untrusted YAML configuration files.

Executive Summary:
A critical code execution vulnerability in the PraisonAI workflow engine allows attackers to achieve full control over the host system using malicious YAML files.

Vulnerability Details

CVE-ID: CVE-2026-40288

Affected Software: PraisonAI / Praisonaiagents

Affected Versions: PraisonAI < 4.5.139, praisonaiagents < 1.5.140

Vulnerability: The workflow engine fails to validate or sandbox YAML inputs, allowing an attacker to execute arbitrary shell commands or Python scripts via the job definition processing functions.

Business Impact

With a CVSS score of 9.8, this flaw allows for total system takeover. An attacker influencing a workflow file can execute arbitrary code on the host, leading to full data compromise, lateral movement within the network, and the potential for persistent backdoors.

Remediation Plan

Immediate Action: Update PraisonAI to version 4.5.139 and praisonaiagents to 1.5.140 immediately.

Proactive Monitoring: Monitor workflow execution logs for unusual shell commands or unexpected Python script invocations originating from the workflow engine.

Compensating Controls: Restrict access to YAML configuration files and ensure they are only editable by authorized personnel within a secure, non-public context.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is critical due to the lack of any sandboxing for user-provided configuration. Immediate patching is required. Furthermore, teams should conduct a forensic review of any workflow files that were modified by untrusted sources to ensure no malicious persistence mechanisms were established prior to patching.

Description Summary:
PraisonAI is vulnerable to arbitrary code execution due to the unsanitized import of a local tools.py file from the current working directory during startup.

Executive Summary:
PraisonAI versions 4.5.138 and below allow unauthenticated attackers to achieve arbitrary code execution on the host system by placing a malicious tools.py file in the project directory.

Vulnerability Details

CVE-ID: CVE-2026-40287

Affected Software: MervinPraison PraisonAI and praisonaiagents

Affected Versions: PraisonAI < 4.5.139, praisonaiagents < 1.5.140

Vulnerability: The application suffers from improper control of code generation and untrusted search path vulnerabilities. It blindly imports and executes code from a local tools.py file without validation, allowing an attacker with local file write access to execute arbitrary Python code in the host environment.

Business Impact

Successful exploitation grants an attacker full control over the PraisonAI process and the host system. Given the CVSS score of 8.4, this vulnerability represents a high risk, as it enables total compromise of sensitive data, credentials, and system integrity within the environment where the AI agent is deployed.

Remediation Plan

Immediate Action: Update the PraisonAI package to version 4.5.139 and praisonaiagents to version 1.5.140 immediately.

Proactive Monitoring: Audit directory permissions for all project workspaces to ensure that untrusted users cannot write files to the directories where PraisonAI is executed.

Compensating Controls: Execute the application within a strictly isolated environment, such as a container or sandbox with read-only access to unnecessary files, to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous because it leverages standard, automated application startup behaviors to execute malicious payloads without requiring specific user interaction.

Analyst Recommendation

This is a critical security flaw that requires immediate attention due to the ease of exploitation and the severity of the potential impact. Organizations must prioritize updating their PraisonAI instances to the specified fixed versions to eliminate the risk of arbitrary code execution. Failure to patch may expose the host infrastructure to unauthorized access and total system compromise.

Description Summary:
PraisonAI contains a sandbox bypass vulnerability in its Python execution environment that allows for arbitrary code execution.

Executive Summary:
The PraisonAI multi-agent system is vulnerable to arbitrary code execution due to an insufficient AST-based sandbox, posing a critical security risk to host environments.

Vulnerability Details

CVE-ID: CVE-2026-40158

Affected Software: MervinPraison PraisonAI

Affected Versions: < 4.5.128

Vulnerability: This vulnerability involves an improper protection mechanism (CWE-693) and code injection (CWE-94) flaw within the Python sandbox. An attacker can bypass AST filtering in the _execute_code_direct function by using dynamic attribute resolution, such as type.getattribute, to access restricted Python attributes and achieve arbitrary code execution.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code on the host system, effectively bypassing the security boundaries intended to contain untrusted agent code. Given the CVSS score of 8.6, this flaw represents a high-severity risk that could lead to full system compromise, unauthorized data access, and potential lateral movement within the infrastructure.

Remediation Plan

Immediate Action: Update the PraisonAI package to version 4.5.128 or later immediately to incorporate the necessary sandbox security improvements.

Proactive Monitoring: Monitor execution logs for unusual Python attribute access patterns or errors originating from the praisonaiagents/tools/python_tools.py module that might indicate an attempt to probe the sandbox.

Compensating Controls: Ensure that any agent code execution is performed within a hardened container or a secondary, isolated environment with restricted system-level permissions to minimize the impact of a potential sandbox escape.

Exploitation Status

Public Exploit Available: No — there is no confirmed public weaponized exploit.

Analyst Notes: As of April 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the sandbox relies on an incomplete blacklist of AST nodes that can be circumvented via dynamic attribute lookups.

Analyst Recommendation

The severity of this vulnerability, combined with the presence of a proof-of-concept, necessitates immediate action. Organizations utilizing PraisonAI must prioritize updating to version 4.5.128 to remediate the sandbox bypass. Failure to patch leaves the host environment exposed to potential arbitrary code execution by any untrusted agent code processed by the system.

Description Summary:
PraisonAI versions prior to 4.5.128 are vulnerable to arbitrary code execution because the system automatically imports and executes module-level code from an untrusted tools.py file.

Executive Summary:
A critical vulnerability in PraisonAI allows unauthenticated attackers to achieve arbitrary code execution by placing a malicious file in the working directory.

Vulnerability Details

CVE-ID: CVE-2026-40156

Affected Software: MervinPraison PraisonAI

Affected Versions: < 4.5.128

Vulnerability: The application utilizes an insecure loading mechanism that automatically executes code from a tools.py file found in the current working directory, regardless of user intent or configuration. This flaw, categorized under CWE-94 and CWE-829, allows an attacker to execute arbitrary code with the privileges of the user running the PraisonAI process.

Business Impact

The ability for an unauthorized party to execute arbitrary code on a system hosting PraisonAI poses a severe risk of total system compromise. Given the CVSS score of 7.8, this vulnerability could lead to unauthorized data access, persistence within the environment, and the potential for lateral movement across the network. Organizations relying on this system for automated agent orchestration face significant operational and security risks if the environment is not secured.

Remediation Plan

Immediate Action: Update the PraisonAI package to version 4.5.128 or later via your package manager to resolve the insecure file loading behavior.

Proactive Monitoring: Monitor file system activity within directories where PraisonAI is executed, specifically looking for the creation of unauthorized or unexpected Python files.

Compensating Controls: Ensure that the service runs with the least privilege necessary, and restrict write access to the working directories used by the application to prevent unauthorized file placement.

Exploitation Status

Public Exploit Available: No (no confirmed public weaponized exploit or published PoC exists in the provided data).

Analyst Notes: As of April 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires only the presence of a file on the disk to trigger execution.

Analyst Recommendation

Due to the severity of this remote code execution flaw and the existence of proof-of-concept evidence, immediate remediation is required. Administrators must prioritize updating to version 4.5.128 immediately to neutralize the risk of unauthorized code execution in their environments.

Description Summary:
PraisonAI fails to validate the integrity or origin of remotely fetched template files, enabling supply chain attacks by executing malicious code.

Executive Summary:
A critical supply chain vulnerability in PraisonAI allows for arbitrary code execution by treating unverified, remotely fetched templates as trusted executable code.

Vulnerability Details

CVE-ID: CVE-2026-40154

Affected Software: PraisonAI

Affected Versions: Prior to 4.5.128

Vulnerability: The application suffers from a lack of integrity verification and origin validation when processing remotely fetched template files. This allows an attacker to inject malicious templates that the system subsequently executes without user confirmation or validation.

Business Impact

The ability to inject and execute arbitrary code via malicious templates creates a severe supply chain risk, potentially leading to unauthorized data access, service disruption, and total system compromise. With a CVSS score of 9.3, this flaw necessitates immediate remediation to prevent attackers from gaining persistent access to the server or integrated environments.

Remediation Plan

Immediate Action: Upgrade the PraisonAI system to version 4.5.128 or later to incorporate the necessary integrity and validation checks.

Proactive Monitoring: Monitor for unexpected outbound network connections from the PraisonAI application to untrusted endpoints and audit logs for unusual template file processing events.

Compensating Controls: Implement strict egress filtering on the application server to prevent the fetching of templates from unauthorized or unknown external domains.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant supply chain risk that could be leveraged for widespread system compromise. Security teams should immediately verify their current PraisonAI version and apply the patch to ensure all template processing is subjected to rigorous integrity verification.

Description Summary:
PraisonAIAgents is vulnerable to Server-Side Request Forgery due to improper validation of URLs in the web_crawl function, allowing attackers to access internal services or local files.

Executive Summary:
A Server-Side Request Forgery vulnerability in PraisonAIAgents allows authenticated attackers to perform unauthorized requests to internal resources and local files.

Vulnerability Details

CVE-ID: CVE-2026-40150

Affected Software: MervinPraison PraisonAIAgents

Affected Versions: < 1.5.128

Vulnerability: The web_crawl function in praisonaiagents/tools/web_crawl_tools.py lacks validation for scheme, hostname, or IP address, allowing an attacker with low privileges to force the agent to fetch internal network resources or local files via file:// URLs.

Business Impact

The exploitation of this vulnerability could lead to the exposure of sensitive cloud metadata, internal service information, or local system files. Given the CVSS score of 7.7, this represents a significant risk to organizational confidentiality, particularly in cloud-native environments where metadata services contain high-value credentials or configuration data.

Remediation Plan

Immediate Action: Upgrade PraisonAIAgents to version 1.5.128 or later to incorporate the necessary URL validation logic.

Proactive Monitoring: Review application logs for unusual outbound connection patterns or requests directed at internal IP ranges, such as 169.254.169.254 or local loopback addresses.

Compensating Controls: Implement strict egress filtering at the network level to prevent the agent from communicating with sensitive internal endpoints or private IP address spaces.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of any scheme or hostname filtering within the agent's web crawling component.

Analyst Recommendation

This vulnerability presents a high risk to internal infrastructure security and must be treated with urgency. Administrators should prioritize updating the PraisonAIAgents package to version 1.5.128 immediately to neutralize the SSRF vector and prevent unauthorized access to sensitive local and cloud-based resources.

Description Summary:
PraisonAI versions prior to 4.5.128 contain an authentication bypass in the approval allowlist API, allowing unauthenticated attackers to modify tool permissions and bypass safety mechanisms.

Executive Summary:
An unauthenticated security bypass in PraisonAI allows attackers to modify tool approval lists, effectively disabling critical safety guardrails for multi-agent systems.

Vulnerability Details

CVE-ID: CVE-2026-40149

Affected Software: MervinPraison PraisonAI

Affected Versions: < 4.5.128

Vulnerability: The application fails to enforce authentication on the /api/approval/allow-list endpoint when the default configuration is used, allowing unauthorized modification of tool permissions. An attacker can add dangerous tools to the approval list, which forces the system to auto-approve potentially malicious agent actions.

Business Impact

The exploitation of this vulnerability directly undermines the integrity of the agent workflow by stripping away human-in-the-loop safety controls. With a CVSS score of 7.9, this high-severity flaw enables an attacker to manipulate system tools to perform unauthorized file operations or system commands, potentially leading to total system compromise or data exfiltration.

Remediation Plan

Immediate Action: Update the PraisonAI package to version 4.5.128 or later via your Python package manager to resolve the authentication flaw.

Proactive Monitoring: Review API access logs for any unauthorized requests to the /api/approval/allow-list endpoint and monitor for unexpected changes to tool approval configurations.

Compensating Controls: If immediate patching is not feasible, ensure that an auth_token is strictly configured for the PraisonAI gateway to prevent unauthenticated access to the underlying management endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows an attacker to manipulate the logic of the safety framework, turning a secured system into an unconstrained execution environment.

Analyst Recommendation

Given the ability for unauthenticated actors to bypass critical safety mechanisms, organizations running PraisonAI must prioritize updating to version 4.5.128 immediately. Failure to patch leaves the system vulnerable to automated manipulation of agent capabilities, which could lead to severe security incidents within the automated environment.

Description Summary:
The PraisonAI multi-agent system lacks authentication on the /media-stream WebSocket endpoint, allowing unauthenticated attackers to exhaust system resources and consume OpenAI API credits.

Executive Summary:
An unauthenticated resource exhaustion vulnerability in MervinPraison PraisonAI allows attackers to drain API credits and crash services via the /media-stream WebSocket endpoint.

Vulnerability Details

CVE-ID: CVE-2026-40116

Affected Software: MervinPraison PraisonAI

Affected Versions: < 4.5.128

Vulnerability: This vulnerability involves a failure to implement authentication or rate limiting on the /media-stream WebSocket endpoint, which allows any unauthenticated attacker to open sessions that consume the server's OpenAI API credentials.

Business Impact

The exploitation of this flaw can lead to significant financial loss through the unauthorized depletion of OpenAI API credits. Furthermore, because the vulnerability allows for uncontrolled resource allocation, it can facilitate a denial of service, rendering the PraisonAI system unavailable to legitimate users. With a CVSS score of 7.5, this high-severity issue necessitates immediate attention to prevent operational disruption and unexpected cloud infrastructure costs.

Remediation Plan

Immediate Action: Update the PraisonAI package to version 4.5.128 or later via PyPI to implement the necessary authentication and rate-limiting controls.

Proactive Monitoring: Monitor WebSocket connection logs for high volumes of traffic or anomalous connection patterns originating from unknown or unauthorized clients.

Compensating Controls: Deploy a Web Application Firewall or WebSocket-aware proxy to restrict access to the /media-stream endpoint to trusted IP ranges until the update is applied.

Exploitation Status

Public Exploit Available: No (Exploit_available: false)

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of rate limiting combined with the exposure of sensitive API keys makes this vector highly attractive for automated abuse.

Analyst Recommendation

Given the ease of exploitation and the potential for direct financial impact, administrators should prioritize updating PraisonAI to version 4.5.128 immediately. Failure to patch leaves the underlying OpenAI API key exposed to unauthorized use, which can result in rapid depletion of service quotas and associated financial liabilities.

Description Summary:
PraisonAI is vulnerable to command argument injection because it fails to sanitize inputs for the gcloud run deploy command, allowing attackers to inject arbitrary environment variables into Cloud Run.

Executive Summary:
A high-severity argument injection vulnerability in PraisonAI allows local attackers with low privileges to manipulate environment variables during service deployment, leading to potential unauthorized configuration.

Vulnerability Details

CVE-ID: CVE-2026-40113

Affected Software: MervinPraison PraisonAI

Affected Versions: < 4.5.128

Vulnerability: This is an improper neutralization of argument delimiters (CWE-88) occurring in the deploy.py script. The application fails to validate that the openai_model, openai_key, and openai_base parameters do not contain commas, allowing a local authenticated attacker to inject arbitrary key-value pairs into the gcloud run deploy command.

Business Impact

Successful exploitation of this vulnerability permits the injection of arbitrary environment variables into a deployed Cloud Run service. This can lead to unauthorized access to cloud resources, potential leakage of sensitive credentials, or redirection of application traffic. With a CVSS score of 8.4, the risk is significant due to the potential for total impact on the confidentiality and integrity of the cloud deployment.

Remediation Plan

Immediate Action: Update the PraisonAI package to version 4.5.128 or later via PyPI to incorporate the input validation fix.

Proactive Monitoring: Review application deployment logs and infrastructure configuration changes for unexpected environment variable definitions or unauthorized modifications to the gcloud deployment process.

Compensating Controls: Ensure that the service account executing the deployment process adheres to the principle of least privilege, restricting its ability to modify critical infrastructure configurations beyond what is strictly necessary for deployment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 11, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any user capable of influencing the configuration parameters passed to the deployment script.

Analyst Recommendation

Given the potential for environment variable injection and the existence of a proof-of-concept, users must prioritize upgrading to version 4.5.128 immediately. Failure to update leaves the deployment pipeline exposed to configuration manipulation that could result in severe security compromises within the cloud environment.

Description Summary:
PraisonAI is vulnerable to command injection via the execute_command function and workflow shell execution, allowing attackers to execute arbitrary commands through crafted YAML or LLM inputs.

Executive Summary:
A critical command injection vulnerability in PraisonAI allows attackers to execute arbitrary shell commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-40088

Affected Software: PraisonAI

Affected Versions: Prior to 4.5.121

Vulnerability: This vulnerability involves improper neutralization of special elements used in an OS command. Attackers can inject arbitrary shell metacharacters through agent workflows, YAML definitions, or LLM-generated tool calls, which the application then executes with system-level privileges.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the underlying host. Given the CVSS score of 9.6, this represents a critical risk that could lead to complete data exfiltration, lateral movement within the network, and full loss of system integrity.

Remediation Plan

Immediate Action: Upgrade the PraisonAI system to version 4.5.121 or later immediately to resolve the command injection flaw.

Proactive Monitoring: Review system logs for unusual shell process spawns or unexpected command execution patterns originating from agent workflows.

Compensating Controls: Implement strict input validation for all YAML definitions and restrict agent workflow permissions to the least privilege necessary to prevent unauthorized shell access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching. Organizations utilizing PraisonAI must prioritize updating to version 4.5.121 to mitigate the risk of arbitrary code execution and potential total system compromise.

Description Summary:
PraisonAI versions prior to 4.5.115 are vulnerable to code injection via the create_agent_centric_tools function, allowing unescaped user input to be executed as template expressions.

Executive Summary:
A critical code injection vulnerability in PraisonAI allows authenticated users to execute arbitrary code by supplying malicious input to the agent framework.

Vulnerability Details

CVE-ID: CVE-2026-39891

Affected Software: MervinPraison PraisonAI

Affected Versions: < 4.5.115

Vulnerability: The vulnerability exists in the create_agent_centric_tools function, which fails to properly sanitize user input before passing it to template rendering engines. An authenticated attacker can leverage this flaw to achieve code execution by injecting malicious template expressions.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for total system compromise. Successful exploitation allows an attacker to execute arbitrary code on the host system, potentially leading to unauthorized data access, full system takeover, and significant operational disruption.

Remediation Plan

Immediate Action: Update the PraisonAI package to version 4.5.115 or later via your package manager (e.g., pip install --upgrade praisonai).

Proactive Monitoring: Review application logs for suspicious input patterns directed at agent configuration endpoints or unexpected file system modifications initiated by the PraisonAI process.

Compensating Controls: Implement strict input validation and restrict access to the agent configuration interface to trusted personnel only until the update is applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it directly translates user-supplied strings into executable code paths within the application.

Analyst Recommendation

Given the high severity of this code injection flaw and the existence of a proof-of-concept, immediate action is required to secure your environment. Administrators should verify their current deployment version and apply the 4.5.115 patch immediately to eliminate the risk of remote code execution.

Description Summary:
PraisonAI versions prior to 4.5.115 are vulnerable to RCE via insecure YAML parsing, allowing execution of arbitrary JavaScript.

Executive Summary:
A critical Remote Code Execution vulnerability in PraisonAI allows attackers to execute arbitrary JavaScript by uploading malicious YAML files.

Vulnerability Details

CVE-ID: CVE-2026-39890

Affected Software: PraisonAI

Affected Versions: Prior to 4.5.115

Vulnerability: The AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML without disabling dangerous tags. This allows an attacker to inject and execute arbitrary JavaScript during the parsing process.

Business Impact

Successful exploitation leads to Remote Code Execution on the server. This allows an attacker to compromise the entire system, access sensitive internal data, and potentially pivot into other parts of the infrastructure, as reflected by the 9.8 CVSS score.

Remediation Plan

Immediate Action: Upgrade PraisonAI to version 4.5.115 or later immediately to patch the insecure YAML parsing.

Proactive Monitoring: Review API logs for uploads of suspicious YAML files and monitor for anomalous JavaScript execution.

Compensating Controls: Implement input validation to ensure that uploaded agent definition files strictly adhere to expected schemas and do not contain dangerous YAML tags.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Insecure deserialization is a severe vulnerability. Administrators must prioritize the upgrade to the patched version of PraisonAI to prevent potential remote code execution attacks against their infrastructure.

Description Summary:
The PraisonAI A2U event stream server fails to perform authentication checks, allowing unauthenticated attackers to access sensitive agent activity data via multiple exposed API endpoints.

Executive Summary:
A critical authentication bypass vulnerability in PraisonAI allows unauthenticated remote attackers to intercept sensitive agent-to-user communication and activity logs.

Vulnerability Details

CVE-ID: CVE-2026-39889

Affected Software: MervinPraison PraisonAI

Affected Versions: < 4.5.115

Vulnerability: This vulnerability is an exposure of sensitive information (CWE-200) caused by the failure of the create_a2u_routes function to implement authentication checks. Unauthenticated attackers can access the /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health endpoints.

Business Impact

The exploitation of this flaw could lead to the unauthorized disclosure of proprietary agent workflows, user interactions, and sensitive system state information. With a CVSS score of 7.5, this high-severity issue poses a significant risk to organizational confidentiality, particularly if the PraisonAI system is utilized for processing internal business logic or sensitive data streams.

Remediation Plan

Immediate Action: Update the PraisonAI package to version 4.5.115 or later immediately to apply the required authentication middleware to the affected endpoints.

Proactive Monitoring: Review web access logs for anomalous requests to the /a2u/ path, specifically monitoring for high-frequency connection attempts from unauthorized IP addresses.

Compensating Controls: If immediate patching is not feasible, implement strict network-level access control lists or a Web Application Firewall (WAF) rule to block public access to the /a2u/ endpoint prefix.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its automatable nature, as the missing authentication allows for trivial data scraping of the event stream.

Analyst Recommendation

Given the ease of exploitation and the exposure of sensitive internal agent communications, organizations utilizing PraisonAI must prioritize this update. Ensure all instances are upgraded to version 4.5.115 immediately to remediate the authentication bypass and prevent unauthorized information disclosure.

Description Summary:
PraisonAI versions prior to 1.5.115 contain a sandbox escape vulnerability in its Python code execution tool, allowing arbitrary code execution.

Executive Summary:
A critical sandbox escape vulnerability in PraisonAI allows attackers to bypass security layers and execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-39888

Affected Software: PraisonAI

Affected Versions: Prior to 1.5.115

Vulnerability: The execute_code() function uses an insufficient AST-based blocklist for sandbox mode. Attackers can chain specific attributes to escape the sandbox, access internal Python built-ins, and achieve Remote Code Execution.

Business Impact

The ability to escape the sandbox environment allows an attacker to execute arbitrary commands with the privileges of the application. With a CVSS score of 9.9, this vulnerability presents an extreme risk to server integrity and data security.

Remediation Plan

Immediate Action: Upgrade PraisonAI to version 1.5.115 or later immediately.

Proactive Monitoring: Monitor for abnormal subprocess activity or attempts to access restricted Python built-ins within the application logs.

Compensating Controls: Run the application within a containerized environment with strict resource limits and read-only filesystems to minimize the impact of a potential escape.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a high-severity sandbox escape that fundamentally undermines the security of the PraisonAI system. Immediate upgrade to the patched version is mandatory to ensure the integrity of the execution environment.

Description Summary:
A broken access control flaw in the Genealogy PHP application allows authenticated users to transfer ownership of arbitrary non-personal team workspaces to their own accounts.

Executive Summary:
A critical access control vulnerability in Genealogy permits authenticated users to perform unauthorized team ownership takeovers.

Vulnerability Details

CVE-ID: CVE-2026-39355

Affected Software: Genealogy

Affected Versions: Prior to 5.9.1

Vulnerability: The application fails to properly validate permissions when transferring team ownership. This allows any authenticated user to escalate their privileges by claiming ownership of teams they do not manage.

Business Impact

This vulnerability presents a significant risk of data exfiltration and unauthorized administrative control over team workspaces. With a CVSS score of 9.9, the impact on organizational data privacy is extreme, as attackers can gain access to all data associated with compromised teams.

Remediation Plan

Immediate Action: Update the Genealogy application to version 5.9.1 or later to remediate the access control logic.

Proactive Monitoring: Audit ownership change logs to identify any unauthorized transfers of team workspaces that occurred prior to patching.

Compensating Controls: Restrict access to the application to trusted internal networks and implement strict session monitoring for unusual account activity.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability for a standard user to seize control of arbitrary workspaces is a critical security failure. Organizations should prioritize updating to version 5.9.1 to ensure that authorization checks are correctly enforced across all team management functions.

Description Summary:
A Path Traversal vulnerability in the PraisonAI Action Orchestrator allows attackers to read or write arbitrary files on the host system.

Executive Summary:
A critical Path Traversal flaw in PraisonAI enables attackers to overwrite sensitive files or execute payloads via the Action Orchestrator.

Vulnerability Details

CVE-ID: CVE-2026-39305

Affected Software: PraisonAI

Affected Versions: Prior to 1.5.113

Vulnerability: The Action Orchestrator fails to sanitize input paths, permitting the use of directory traversal sequences (../). This allows an attacker to escape the designated workspace directory and perform unauthorized file system operations.

Business Impact

With a CVSS score of 9.0, this vulnerability allows for significant system-level impact. Attackers can gain persistence, modify configuration files, or overwrite binaries, leading to total compromise of the PraisonAI host.

Remediation Plan

Immediate Action: Upgrade PraisonAI to version 1.5.113 or later to patch the path validation logic.

Proactive Monitoring: Monitor file system activity logs for unauthorized modifications to sensitive directories and binary files.

Compensating Controls: Run the application within a containerized environment with a read-only root file system and strictly limited volume mounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Path traversal vulnerabilities in orchestration systems are extremely dangerous. Organizations must upgrade to version 1.5.113 immediately to prevent potential remote code execution or system file tampering.

Description Summary:
A high-severity vulnerability has been discovered in the PraisonAI multi-agent teams system.

Executive Summary:
A critical vulnerability in the PraisonAI multi-agent system could allow unauthorized access or manipulation, presenting a significant risk to organizational workflows.

Vulnerability Details

CVE-ID: CVE-2026-34955

Affected Software: PraisonAI PraisonAI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the PraisonAI platform, a system designed for managing multi-agent teams. With a CVSS score of 8.8, the flaw likely involves a critical failure in authorization or input processing that could be exploited to compromise the agent system's integrity.

Business Impact

PraisonAI is used for complex, multi-agent operations; therefore, a compromise could allow an attacker to hijack agent workflows, inject malicious instructions, or access sensitive data processed by the agents. The high CVSS score reflects the potential for widespread operational impact if the system is compromised.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the PraisonAI development team immediately.

Proactive Monitoring: Monitor agent activity logs for unauthorized task execution or unexpected changes to system configurations.

Compensating Controls: Implement strict access control lists (ACLs) for the PraisonAI interface and ensure the environment is isolated from untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for high-impact disruption, organizations utilizing PraisonAI must act quickly to patch their systems. Ensuring the platform is up to date is essential to maintaining the security and reliability of agent-based operations.

Description Summary:
A security vulnerability has been identified in the PraisonAI multi-agent teams system.

Executive Summary:
A vulnerability in the PraisonAI platform poses a risk to automated agent integrity, requiring immediate attention from security administrators.

Vulnerability Details

CVE-ID: CVE-2026-34954

Affected Software: PraisonAI PraisonAI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the PraisonAI multi-agent system. The flaw, carrying a CVSS score of 8.6, indicates a severe issue that could potentially be used to disrupt the operation or security of the multi-agent environment.

Business Impact

Exploitation of this vulnerability could lead to the unauthorized manipulation of agent teams, potentially resulting in the compromise of sensitive tasks or data managed by the system. The high CVSS score underscores the urgency of addressing this risk to prevent operational degradation.

Remediation Plan

Immediate Action: Update the PraisonAI system to the most recent version provided by the vendor to remediate the vulnerability.

Proactive Monitoring: Review logs for unusual agent behavior or unauthorized access attempts to the PraisonAI management interface.

Compensating Controls: Use network-level controls to restrict access to the PraisonAI management console to authorized internal personnel only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability as a high priority. Applying the necessary updates is critical to ensure that the PraisonAI environment remains secure and resistant to unauthorized interference.

Description Summary:
A critical authentication bypass in PraisonAI's OAuthManager allows unauthenticated attackers to gain full access to all registered tools and agent capabilities by providing any arbitrary token.

Executive Summary:
PraisonAI versions prior to 4.5.97 are vulnerable to a critical authentication bypass that grants unauthenticated attackers full administrative control over multi-agent systems.

Vulnerability Details

CVE-ID: CVE-2026-34953

Affected Software: PraisonAI PraisonAI

Affected Versions: Prior to version 4.5.97

Vulnerability: The OAuthManager.validate_token() function incorrectly returns a success state for any token not found in its default empty internal store. This allows an unauthenticated remote attacker to bypass security controls using any arbitrary Bearer token.

Business Impact

A successful exploit grants an attacker full access to the multi-agent system's tools and capabilities, leading to total compromise of the agentic workflow. Given the CVSS score of 9.1, this represents a critical risk of unauthorized data access, manipulation of AI processes, and potential lateral movement within the environment.

Remediation Plan

Immediate Action: Update the PraisonAI installation to version 4.5.97 or later immediately to correct the token validation logic.

Proactive Monitoring: Review HTTP access logs for the MCP server to identify requests containing unrecognized Bearer tokens or unusual agent activity.

Compensating Controls: Implement network-level access control lists (ACLs) to restrict access to the MCP server to trusted IP addresses only until the patch is applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the trivial nature of the bypass and the high CVSS score, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it effectively nullifies the authentication layer of the platform. Organizations utilizing PraisonAI must prioritize the update to version 4.5.97 immediately to prevent unauthorized access to sensitive agent tools.

Description Summary:
PraisonAI Gateway prior to 4.5.97 lacks authentication for WebSocket and info endpoints. Attackers can enumerate AI agents and send arbitrary messages to manipulate agent tools.

Executive Summary:
The PraisonAI Gateway is vulnerable to unauthenticated access, allowing any network client to enumerate AI agents and send arbitrary commands to their tool sets.

Vulnerability Details

CVE-ID: CVE-2026-34952

Affected Software: PraisonAI PraisonAI Gateway

Affected Versions: Prior to version 4.5.97

Vulnerability: The gateway server exposes agent topology at /info and accepts WebSocket connections at /ws without any authentication. This allows unauthenticated attackers to discover all registered agents and inject arbitrary messages into the agent communication stream.

Business Impact

An attacker can hijack AI workflows, exfiltrate data from agent interactions, or trigger unauthorized actions through the agents' tool sets. The CVSS score of 9.1 reflects the critical risk of unauthenticated control over automated AI systems, which may have access to sensitive corporate resources.

Remediation Plan

Immediate Action: Update the PraisonAI Gateway to version 4.5.97 or later, which implements the necessary authentication checks for these endpoints.

Proactive Monitoring: Monitor WebSocket connection logs for unauthorized IP addresses and audit agent activity for unexpected or anomalous tool executions.

Compensating Controls: Place the PraisonAI Gateway behind a VPN or use a reverse proxy to enforce authentication before requests reach the /ws and /info endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, the lack of authentication on public-facing endpoints makes this a trivial target for attackers.

Analyst Recommendation

Securing AI infrastructure is critical as these systems are increasingly integrated into business processes. Organizations using PraisonAI must update to version 4.5.97 immediately to prevent unauthorized actors from controlling their AI agents. Ensure that all management endpoints are strictly authenticated and not exposed to the open internet.

Description Summary:
PraisonAI agents prior to 1.5.90 contain a sandbox bypass in the execute_code() function. Attackers can execute arbitrary OS commands on the host by bypassing the safe attribute wrapper.

Executive Summary:
PraisonAI agents are vulnerable to a critical sandbox bypass that allows unauthenticated attackers to achieve arbitrary OS command execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-34938

Affected Software: PraisonAI praisonai-agents

Affected Versions: Prior to version 1.5.90

Vulnerability: The execute_code() function in the praisonai-agents package uses a flawed three-layer sandbox. By passing a string subclass with an overridden startswith() method to the _safe_getattr wrapper, an attacker can bypass all restrictions and execute arbitrary Python and OS commands.

Business Impact

A successful exploit grants the attacker full control over the host system running the AI agents. With a CVSS score of 10.0, this is the most severe type of vulnerability, potentially leading to full data exfiltration, malware installation, and complete infrastructure compromise.

Remediation Plan

Immediate Action: Update the praisonai-agents package to version 1.5.90 or later immediately to fix the sandbox bypass logic.

Proactive Monitoring: Audit system logs for unusual process spawning from the AI agent service and monitor for unauthorized network connections initiated by the host.

Compensating Controls: Run AI agents in highly isolated environments, such as dedicated virtual machines or hardened containers with minimal privileges and no access to sensitive host resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. The technical nature of the bypass suggests it could be easily weaponized by researchers or malicious actors.

Analyst Recommendation

A CVSS 10.0 vulnerability requires immediate emergency response. The sandbox intended to protect the host from untrusted code is completely ineffective. Organizations must update to version 1.5.90 immediately and should consider the underlying host compromised if the service was exposed to untrusted inputs.

Description Summary:
A security vulnerability has been identified in the PraisonAI multi-agent teams system.

Executive Summary:
A vulnerability in the PraisonAI platform requires immediate attention to ensure the integrity and security of automated agent operations.

Vulnerability Details

CVE-ID: CVE-2026-34937

Affected Software: PraisonAI PraisonAI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the PraisonAI multi-agent system. With a CVSS score of 7.8, the flaw indicates a significant security risk that could be leveraged to interfere with system operations or gain unauthorized access to agent functions.

Business Impact

Successful exploitation could allow an attacker to disrupt agent workflows or access information processed by the system. Given the 7.8 CVSS score, this is a high-severity issue that could lead to data integrity loss or operational instability.

Remediation Plan

Immediate Action: Apply all security patches released by the PraisonAI vendor to address this vulnerability.

Proactive Monitoring: Monitor logs for unauthorized access or unexpected changes to agent configurations within the PraisonAI system.

Compensating Controls: Limit access to the PraisonAI management interface using strong authentication and network access controls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using PraisonAI should prioritize this update. Proactive patching is essential to prevent potential exploitation and ensure the continued security of the multi-agent environment.

Description Summary:
A security vulnerability has been discovered in the PraisonAI multi-agent teams system.

Executive Summary:
A vulnerability in the PraisonAI platform could facilitate unauthorized system interaction, necessitating prompt remediation.

Vulnerability Details

CVE-ID: CVE-2026-34936

Affected Software: PraisonAI PraisonAI

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the PraisonAI multi-agent system. The CVSS score of 7.7 highlights a significant security risk that should be addressed to prevent potential exploitation by unauthorized actors.

Business Impact

Exploitation of this vulnerability could lead to the degradation of agent-based services or unauthorized access to internal resources. Addressing this high-severity flaw is critical to maintaining the security and operational continuity of the PraisonAI platform.

Remediation Plan

Immediate Action: Update to the latest version of the PraisonAI system as recommended by the vendor.

Proactive Monitoring: Review system logs for signs of anomalous activity or unauthorized access attempts targeting the PraisonAI agents.

Compensating Controls: Implement strong access controls and ensure the system is not accessible from untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with high priority. Applying the latest security updates will mitigate the risks associated with this flaw and help protect the PraisonAI environment from potential compromise.

Description Summary:
PraisonAI CLI versions 4.5.15 through 4.5.68 are vulnerable to OS command injection via the --mcp argument. The argument is passed to the system shell without sanitization.

Executive Summary:
The PraisonAI CLI is vulnerable to a critical OS command injection flaw, allowing attackers to execute arbitrary commands as the current user via a crafted --mcp argument.

Vulnerability Details

CVE-ID: CVE-2026-34935

Affected Software: PraisonAI PraisonAI CLI

Affected Versions: From version 4.5.15 to before version 4.5.69

Vulnerability: The --mcp command-line argument is passed directly to shlex.split() and subsequently to anyio.open_process() without any validation or sanitization. This allows an attacker to inject shell commands that will be executed with the privileges of the user running the CLI tool.

Business Impact

This vulnerability could be used for local privilege escalation or as part of a larger exploit chain to achieve remote command execution if the CLI is called by a web service. The CVSS score of 9.8 underscores the critical risk of arbitrary command execution on the host machine.

Remediation Plan

Immediate Action: Update the PraisonAI CLI to version 4.5.69 or later to ensure all command-line arguments are properly sanitized.

Proactive Monitoring: Audit shell command history and process execution logs for suspicious use of the --mcp flag or unexpected child processes originating from the PraisonAI CLI.

Compensating Controls: Implement strict AppArmor or SELinux profiles for the CLI tool to restrict its ability to execute unauthorized system commands or access sensitive files.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. Command injection via CLI arguments is a common vector for attackers who have gained an initial foothold on a system.

Analyst Recommendation

The direct passing of unsanitized user input to process execution functions is a high-risk practice. Administrators should update to version 4.5.69 immediately. We also recommend that developers use safer APIs for process execution that do not involve shell interpretation whenever possible.

Description Summary:
PraisonAI prior to 4.5.90 is vulnerable to SQL injection in the get_all_user_threads function. Attackers can gain full database access by injecting malicious payloads into thread IDs.

Executive Summary:
PraisonAI contains a critical SQL injection vulnerability that allows attackers to execute arbitrary database queries and gain full access to sensitive stored data.

Vulnerability Details

CVE-ID: CVE-2026-34934

Affected Software: PraisonAI PraisonAI

Affected Versions: Prior to version 4.5.90

Vulnerability: The get_all_user_threads function constructs raw SQL queries using f-strings with unescaped thread IDs. An attacker can store a malicious payload in a thread ID via the update_thread function, which is then executed when the application attempts to load the thread list.

Business Impact

This vulnerability allows for the complete compromise of the application's database. Attackers can read, modify, or delete all stored data, including user credentials and proprietary AI training data. The CVSS score of 9.8 reflects the high probability of total data loss and unauthorized administrative access.

Remediation Plan

Immediate Action: Update PraisonAI to version 4.5.90 or later to implement parameterized queries and proper input sanitization.

Proactive Monitoring: Monitor database logs for unusual query patterns, such as those containing unexpected SQL keywords (e.g., UNION, SELECT, SLEEP) in the thread ID fields.

Compensating Controls: Deploy a WAF with SQL injection protection rules to detect and block malicious payloads in application requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. Because this is a stored SQL injection, the payload may remain dormant until the vulnerable function is called.

Analyst Recommendation

SQL injection remains one of the most damaging web vulnerabilities. Given the 9.8 severity, it is critical to apply the update to version 4.5.90 immediately. Organizations should also conduct a database audit to ensure no unauthorized data exfiltration has occurred prior to patching.