PraisonAI: Fifteen High-to-Critical Vulnerabilities Disclosed in Multi-Agent System
Key findings • Fifteen PraisonAI vulnerabilities disclosed on October 23, 2026, ranging from High to Critical severity. • Critical CVE-2026-57116 allows unauthenticated access to the AgentOS …
Key findings
- Fifteen PraisonAI vulnerabilities disclosed on October 23, 2026, ranging from High to Critical severity.
- Critical CVE-2026-57116 allows unauthenticated access to the AgentOS FastAPI chat route.
- Multiple flaws involve insecure handling of dangerous tools, file operations, and input validation.
- Authentication and authorization bypasses found in Slack and Discord bot integrations.
- Most vulnerabilities patched in PraisonAI versions 4.6.59 and 4.6.61.
- PraisonAI platform versions prior to 0.1.5 vulnerable to permanent resource deletion.
On October 23, 2026, a batch of fifteen vulnerabilities was disclosed for PraisonAI, a multi-agent teams system. The vulnerabilities, disclosed within a one-hour window, range in severity from High to Critical, with CVSS scores up to 9.8. These flaws expose various weaknesses in authentication, authorization, and secure handling of user inputs across different components of the PraisonAI platform. The widespread nature of these vulnerabilities across multiple versions suggests a need for immediate attention from users and administrators.
Several vulnerabilities stem from inadequate authentication and authorization mechanisms. CVE-2026-57116, a Critical severity flaw, highlights an unauthenticated AgentOS FastAPI deployment surface that directly calls the agent.chat route without proper checks. Similarly, CVE-2026-57146 points to unauthenticated event streaming in the A2U system, allowing unauthorized access to events. CVE-2026-56835 indicates that the Slack bot's message event handler bypasses user and channel restrictions in the app_mention event handler, potentially allowing unauthorized users to interact with the bot.
Input validation and secure execution are also compromised in several instances. CVE-2026-57142 and CVE-2026-56838 reveal issues with PraisonAI's recipe execution, where the dangerous-tool policy, intended to block unauthorized tools, can be bypassed. CVE-2026-57117 describes how file operations in LocalManagedAgent/SandboxedAgent can be manipulated through shell command injection due to raw path arguments. CVE-2026-56834 and CVE-2026-57114 show weaknesses in PraisonAI's Dynamic Context Discovery and Async Jobs API, respectively, where artifact path validation and webhook URL validation are insufficient, potentially leading to unauthorized access or execution.
Other vulnerabilities include CVE-2026-57121, where workspace members can permanently delete any resource, regardless of creator, in versions prior to 0.1.5 of the praisonai-platform. CVE-2026-57113 details how the template loader accepts and caches user-controlled GitHub template paths and refs verbatim, posing a risk if malicious templates are loaded. CVE-2026-56836 describes an optional webhook secret in the LinearBot, which, when absent, allows unverified webhooks to be processed. CVE-2026-56837 also relates to the LinearBot, where the webhook listener starts on 0.0.0.0 and treats the secret as optional, leading to skipped signature verification. CVE-2026-56833 exposes filesystem-backed history and terminal-log storage in the Dynamic Context module, with insufficiently validated agent-callable tool factories. CVE-2026-56832 details how the DiscordApproval bot can be triggered by any user message classified as approval, not just bot messages. Finally, CVE-2026-56836 points to an issue with the installed console entrypoint, where a deprecated Typer command is still dispatched.
The majority of these vulnerabilities affect versions from 4.2.1 up to, but not including, 4.6.59 or 4.6.61. The fixes for most of these issues are included in version 4.6.59 and 4.6.61. Users are strongly advised to update to the patched versions to mitigate these security risks. The rapid disclosure of these fifteen vulnerabilities highlights potential systemic issues within the PraisonAI platform that require thorough review and remediation by the vendor.
The disclosure of this large batch of vulnerabilities, particularly those related to authentication bypass and insecure input handling, presents a significant risk to PraisonAI users. The ability for unauthenticated access to sensitive routes and the potential for arbitrary resource deletion or command injection necessitate immediate patching. Administrators should prioritize updating their PraisonAI instances to the latest secure versions to protect their systems from potential exploitation.
The broad range of affected versions and the critical nature of some flaws underscore the importance of timely security updates for complex multi-agent systems like PraisonAI. Users should remain vigilant for any further advisories from PraisonAI regarding these or other security issues.
Key findings from this batch include:
- Critical unauthenticated access to AgentOS FastAPI chat route in CVE-2026-57116.
- Multiple vulnerabilities related to insecure handling of dangerous tools and file operations.
- Bypasses in authentication and authorization found in Slack and Discord bots.
- Vulnerabilities span across multiple components including A2U, recipe execution, and template loading.
- Most issues are fixed in PraisonAI versions 4.6.59 and 4.6.61.
- A critical flaw in resource deletion for praisonai-platform versions prior to 0.1.5.
CVEs disclosed in this batch include CVE-2026-57146, CVE-2026-57142, CVE-2026-57121, CVE-2026-57117, CVE-2026-57116, CVE-2026-57114, CVE-2026-57113, CVE-2026-56840, CVE-2026-56838, CVE-2026-56837, CVE-2026-56836, CVE-2026-56835, CVE-2026-56834, CVE-2026-56833, and CVE-2026-56832.