TI-2026-79612 Aliases CVE-2026-56835

PraisonAI Slack app_mention events bypass user and channel checks

HIGH 71CWE-862Published 2026-10-23 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

PraisonAI is a multi-agent teams system. Its Slack bot applies the configured allowed_users, allowed_channels and unknown-user pairing policy in the normal message handler but not in the app_mention handler. Versions from 3.11.0 before 4.6.59 are affected: a Slack workspace user who can mention the bot in a channel where the app is present can trigger the configured agent even when the sender is not in BotConfig.allowed_users, the channel is not in BotConfig.allowed_channels, and unknown_user_policy="deny" is set, although the message handler drops the same event content.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00215 11th percentileScored 2026-11-07

Fix Fixed PraisonAI (MervinPraison): 4.6.59praisonai (PyPI): 4.6.59

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MervinPraison	PraisonAI	3.11.0 to before 4.6.59	4.6.59	Patch available	CNA
—	praisonai (PyPI)	3.11.0 to before 4.6.59	4.6.59	Patch available	GHSA-qvpf-j64c-jmhr

PraisonAI VendorMervinPraison Affected 3.11.0 to before 4.6.59 Fixed in 4.6.59 Patch available CNA
praisonai (PyPI) Vendor— Affected 3.11.0 to before 4.6.59 Fixed in 4.6.59 Patch available GHSA-qvpf-j64c-jmhr

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:praison:praisonai::::::::	—	—	MervinPraison

cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions — — ·MervinPraison

Remediation

Upgrade the PyPI package praisonai to version 4.6.59, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA PraisonAI (MervinPraison) Fixed in 4.6.59
Fix · GHSA-qvpf-j64c-jmhr praisonai (PyPI) Fixed in 4.6.59 Advisory →

Timeline

2026-10-23 Threatist record created from CVE-2026-56835
2026-10-24 Priority changed: MEDIUM → LOW
2026-10-29 CISA SSVC decision points changed
2026-10-29 Priority changed: LOW → HIGH

References

Other 2

TI-2026-79619 Missing authentication in PraisonAI AgentOS exposes agent chat CVSS 3.1CRITICAL 9.8
TI-2026-71236 Missing access control in PraisonAI AgentTeam exposes agent endpoints CVSS 3.1CRITICAL 9.8
TI-2026-44052 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent CVSS 4.0CRITICAL 10.0
TI-2026-41123 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) CVSS 3.1CRITICAL 9.8
TI-2026-41122 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery CVSS 3.1CRITICAL 9.8
TI-2026-41118 PraisonAI MCPServer exposes unauthenticated HTTP tools/call CVSS 3.1CRITICAL 9.8

See all 177 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences