PraisonAI Discord approval accepts unrelated messages as approvals
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.
Summary
PraisonAI versions from 4.5.2 before 4.6.59 contain a flaw in the praisonai.bots.DiscordApproval backend. It approves a pending dangerous tool call when any later non-bot message in the configured Discord channel contains approval text such as yes, without checking that the message answers the request. Any user who can post in that channel can therefore approve a high-risk tool call (CWE-863).
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MervinPraison | PraisonAI | 4.5.2 to before 4.6.59 | 4.6.59 | Patch available | CNA |
| — | praisonai (PyPI) | 4.5.2 to before 4.6.59 | 4.6.59 | Patch available | GHSA-8579-rgg5-ph2m |
- PraisonAI VendorMervinPraison Affected 4.5.2 to before 4.6.59 Fixed in 4.6.59 Patch available CNA
- praisonai (PyPI) Vendor— Affected 4.5.2 to before 4.6.59 Fixed in 4.6.59 Patch available GHSA-8579-rgg5-ph2m
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* | — | — | MervinPraison |
- cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions — — ·MervinPraison
Remediation
Upgrade the praisonai PyPI package to version 4.6.59. The sources list no fixed version for PraisonAI.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA PraisonAI (MervinPraison) Fixed in 4.6.59
- Fix · GHSA-8579-rgg5-ph2m praisonai (PyPI) Fixed in 4.6.59 Advisory →
Timeline
- 2026-10-23 Threatist record created from CVE-2026-56832
- 2026-10-24 Priority changed: MEDIUM → LOW
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: LOW → HIGH
References
More MervinPraison vulnerabilities
- TI-2026-79619 Missing authentication in PraisonAI AgentOS exposes agent chat CVSS 3.1CRITICAL 9.8
- TI-2026-71236 Missing access control in PraisonAI AgentTeam exposes agent endpoints CVSS 3.1CRITICAL 9.8
- TI-2026-44052 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent CVSS 4.0CRITICAL 10.0
- TI-2026-41123 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) CVSS 3.1CRITICAL 9.8
- TI-2026-41122 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery CVSS 3.1CRITICAL 9.8
- TI-2026-41118 PraisonAI MCPServer exposes unauthenticated HTTP tools/call CVSS 3.1CRITICAL 9.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences