CVE-2026-56832— PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
Quick assessment
Affected
MervinPraison PraisonAI
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PraisonAI 是一个多智能体团队协作系统。在版本 4.5.2 至 4.6.59（不含）之间， 模块存在安全漏洞：当它在配置的 Discord 频道中检测到任何后续的非机器人消息，且该消息内容被分类为“批准”（例如包含"yes"）时，便会批准待处理的高风险工具调用。因此，任何拥有该批准频道发帖权限的用户，只需在批准提示消息出现后发送"yes"，即可批准待处理的高风险工具调用。 同一攻击面（PoV）还表明，Slack 和 Telegram 消息批准后端也缺乏明确的批准者白名单参数，但本次报告的主要严重问题在于 D
Possible ATT&CK Techniques 2 AI
T1566.002 · Spearphishing Link T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.5.2, < 4.6.59 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-56832
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | PraisonAI | >= 4.5.2, < 4.6.59 | - |
|
II. Public POCs for CVE-2026-56832
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56832
请登录查看更多情报信息。
Same Patch Batch · MervinPraison · 2026-10-23 · 16 CVEs total
| CVE-2026-57116 | 9.8 CRITICAL | PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remo |
| CVE-2026-56840 | 8.8 HIGH | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-pa |
| CVE-2026-57117 | 8.8 HIGH | PraisonAI: Compute-bridged file tools allow shell command injection |
| CVE-2026-57144 | 8.8 HIGH | PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is |
| CVE-2026-56837 | 8.6 HIGH | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing |
| CVE-2026-56835 | 8.3 HIGH | PraisonAI Slack app_mention bypasses configured user/channel authorization |
| CVE-2026-56836 | 8.2 HIGH | PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard |
| CVE-2026-57113 | 8.1 HIGH | PraisonAI GitHub template cache path traversal allows outside-cache file write and directo |
| CVE-2026-57121 | 8.1 HIGH | PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' co |
| CVE-2026-56838 | 7.8 HIGH | PraisonAI recipe.run_stream skips dangerous-tool policy enforcement |
| CVE-2026-57142 | 7.8 HIGH | PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous |
| CVE-2026-56833 | 7.5 HIGH | PraisonAI Dynamic Context history and terminal tools read files outside configured storage |
| CVE-2026-56834 | 7.5 HIGH | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storag |
| CVE-2026-57146 | 7.5 HIGH | PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated b |
| CVE-2026-57114 | 7.2 HIGH | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding |
IV. Related Vulnerabilities
Same product: PraisonAI
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow
Same vendor: MervinPraison
-
CVE-2026-57117
PraisonAI: Compute-bridged file tools allow shell command in -
CVE-2026-57146
PraisonAI A2U incomplete authentication fix leaves current s -
CVE-2026-57144
PraisonAI SandlockSandbox falls back to unrestricted subproc -
CVE-2026-57142
PraisonAI recipe workflow policy can be bypassed by declarin -
CVE-2026-57121
PraisonAI: Missing ownership check on DELETE endpoints allow
Same weakness: CWE-345
-
CVE-2026-115937
Unauthenticated payment reuse allows unpaid orders to be mar -
CVE-2026-114050
vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal -
CVE-2026-112939
filelock: SoftFileLock removes a live holder's marker when a -
CVE-2026-112265
LangBot through 4.11.0 Missing Lark/Feishu Webhook Authentic -
CVE-2026-112161
Lack of integrity checks in Mobatek’s MobaXterm
V. Comments for CVE-2026-56832
No comments yet