CVE-2026-40149 affects MervinPraison's PraisonAI multi-agent system. The vulnerability arises because the /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no authentication token is set, which is the default configuration. Attackers can add dangerous tool names such as shell_exec or file_write to the allowlist, causing the ExecApprovalManager to auto-approve all future invocations of these tools by agents. This bypasses the human-in-the-loop approval mechanism designed to prevent unsafe tool execution. The issue is resolved in PraisonAI version 4.5.128.

An attacker can bypass the safety mechanism that requires human approval for executing potentially dangerous tools by modifying the allowlist without authentication. This can lead to unauthorized execution of critical commands or file operations, impacting integrity and confidentiality. The CVSS score is 7.9 (high severity), indicating significant risk if exploited. There are no known exploits in the wild at this time.

Upgrade PraisonAI to version 4.5.128 or later, where this vulnerability is fixed. Until the upgrade, ensure that an auth_token is configured to prevent unauthenticated access to the /api/approval/allow-list endpoint. Patch status is not explicitly stated beyond the fix in 4.5.128; check vendor advisories for the latest remediation guidance.