high advisory October 23, 2026 updated

PraisonAI: Authorization bypass in approval backends (CVE-2026-56832)

PraisonAI versions 4.5.2 to before 4.6.59 contain an authorization bypass vulnerability in Discord, Slack, and Telegram approval backends, allowing unauthorized users to approve high-risk multi-agent tool calls.

CVE search metadata

CVE search record: CVE-2026-56832. Severity: high. CVSS: 8.8. EPSS: 0.15%. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-56834. Severity: high. CVSS: 7.5. EPSS: 0.37%. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-56835. Severity: high. CVSS: 8.3. EPSS: 0.21%. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-56836. Severity: high. CVSS: 8.2. EPSS: 0.23%. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-56837. Severity: high. CVSS: 8.6. EPSS: 0.19%. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-56838. Severity: high. CVSS: 7.8. EPSS: 0.15%. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-56840. Severity: high. CVSS: 8.8. EPSS: 0.38%. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-57113. Severity: high. CVSS: 8.1. EPSS: 0.40%. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-57114. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-57117. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-57142. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-57144. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

CVE search record: CVE-2026-57146. KEV: no. Product: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58), PraisonAI (>= 3.11.0, < 4.6.59), PraisonAI (>= 4.5.112, < 4.6.59), PraisonAI (>= 4.6.56, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.59), praisonai (4.5.2 to < 4.6.59), PraisonAI (2.6.0 - 4.6.58), PraisonAI (>= 4.5.126, < 4.6.59), PraisonAI (>= 4.6.10, < 4.6.59), PraisonAI (>= 4.5.87, < 4.6.61), PraisonAI (>= 4.5.110, < 4.6.61), PraisonAI (>= 4.5.115, < 4.6.61). Brief: PraisonAI: Authorization bypass in approval backends (CVE-2026-56832). Brief link: https://feed.craftedsignal.io/briefs/2026-10-praisonai-auth-bypass/

Triage facts

Revision 1

Applicability: PraisonAI (4.5.2 to before 4.6.59), PraisonAI (3.8.1 - 4.6.58) +11
Evidence: Unknown
Severity: High
Action: Elevated
Sources: 13 public sources
Freshness: Revision 1Oct 23, 13:40 UTC
Vulnerabilities: 13 CVEs
Source quality: A2Roughly even chance

What's new

1. new product Oct 29, 19:57 via nvd
2. new product Oct 29, 19:57 via nvd
3. new product Oct 29, 19:57 via nvd
4. new product Oct 29, 19:57 via nvd
5. new product Oct 29, 19:57 via nvd

PraisonAI, a multi-agent teams system, contains an authorization bypass vulnerability (CVE-2026-56832) affecting versions 4.5.2 to before 4.6.59. The issue involves the Discord, Slack, and Telegram messaging approval backends. In the Discord backend, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending "yes" because the system does not require the message to be a reply or request-bound. Slack and Telegram backends lack an explicit approver allowlist parameter. This issue was patched in version 4.6.59.

Immediate actions

Upgrade PraisonAI to version 4.6.59 or later

IT Operations 48h

Threat Hunt

Search application logs for unusual artifact_path parameters containing traversal sequences such as ../

T1083 high high confidence hunt now

Data: Application logs capturing tool call arguments

Identify PraisonAI processes running with the recipe serve command on non-localhost interfaces

T1190 high high confidence hunt now

Data: Host process monitoring (process command line), Network listening port activity

Identify unauthorized tool approvals in application logs

T1059.007 high medium confidence hunt now

Data: Application audit logs for /approve/{request_id}/decide

Search application logs or process execution history for PraisonAI template resolution attempts containing directory traversal characters

T1059.003 high medium confidence hunt now

Data: Application logs, Process command line arguments

Mitigations

Upgrade PraisonAI to version 4.6.59

immediate IT Operations

CVE-2026-56834

Restrict network access to PraisonAI ports via firewall or host-based ACLs

immediate IT Operations

CVE-2026-56836

Upgrade to version 4.6.59

immediate IT Operations

CVE-2026-57113

Affected

Vendors

PraisonAI

Products

PraisonAI 4.5.2 to before 4.6.59

PraisonAI 3.8.1 - 4.6.58

PraisonAI >= 3.11.0, < 4.6.59

PraisonAI >= 4.5.112, < 4.6.59

PraisonAI >= 4.6.56, < 4.6.59

PraisonAI >= 4.5.87, < 4.6.59

praisonai 4.5.2 to < 4.6.59

PraisonAI 2.6.0 - 4.6.58

PraisonAI >= 4.5.126, < 4.6.59

PraisonAI >= 4.6.10, < 4.6.59

PraisonAI >= 4.5.87, < 4.6.61

PraisonAI >= 4.5.110, < 4.6.61

PraisonAI >= 4.5.115, < 4.6.61

CVEs

8.8 0.15%

7.5 0.37%

8.3 0.21%

8.2 0.23%

8.6 0.19%

7.8 0.15%

8.8 0.38%

8.1 0.40%

CPE identifiers

praisonai:praisonai praison:praisonai

References

MITRE ATT&CK

T1083 · TA0007

File and Directory Discovery

Discovery

high

As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data.

T1552 · TA0009

Unsecured Credentials

Collection

high

As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data.

T1059.007 · TA0001

JavaScript

Initial Access

high

An attacker-controlled tool argument can inject JavaScript into that page.