CVE-2026-40149: CWE-396: Declaration of Catch for Generic Exception in MervinPraison PraisonAI
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth_token is configured (the default). By adding dangerous tool names (e.g., shell_exec, file_write) to the allowlist, an attacker can cause the ExecApprovalManager to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce. This vulnerability is fixed in 4.5.128.
AI Analysis
Technical Summary
PraisonAI versions before 4.5.128 have a security flaw in the gateway's /api/approval/allow-list endpoint that permits unauthenticated modification of the tool approval allowlist if no authentication token is configured. This allows attackers to insert dangerous tools into the allowlist, leading the ExecApprovalManager to auto-approve these tools without human oversight. This bypasses the designed safety mechanism intended to prevent unauthorized or unsafe tool execution. The vulnerability is tracked as CWE-396 (Declaration of Catch for Generic Exception) and has a CVSS 3.1 base score of 7.9, indicating high severity. The issue is resolved in version 4.5.128.
Potential Impact
An attacker can bypass the human-in-the-loop safety mechanism by adding dangerous tools to the approval allowlist without authentication, potentially leading to unauthorized execution of harmful commands or actions within the PraisonAI system. This compromises the integrity and safety controls of the multi-agent system, increasing risk of misuse or damage. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in PraisonAI version 4.5.128. Users should upgrade to version 4.5.128 or later to remediate this issue. Until upgraded, ensure that an auth_token is configured to prevent unauthenticated access to the /api/approval/allow-list endpoint. Patch status is not explicitly stated beyond the fix in 4.5.128; verify with vendor advisories for the latest remediation guidance.
CVE-2026-40149: CWE-396: Declaration of Catch for Generic Exception in MervinPraison PraisonAI
Description
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth_token is configured (the default). By adding dangerous tool names (e.g., shell_exec, file_write) to the allowlist, an attacker can cause the ExecApprovalManager to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce. This vulnerability is fixed in 4.5.128.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PraisonAI versions before 4.5.128 have a security flaw in the gateway's /api/approval/allow-list endpoint that permits unauthenticated modification of the tool approval allowlist if no authentication token is configured. This allows attackers to insert dangerous tools into the allowlist, leading the ExecApprovalManager to auto-approve these tools without human oversight. This bypasses the designed safety mechanism intended to prevent unauthorized or unsafe tool execution. The vulnerability is tracked as CWE-396 (Declaration of Catch for Generic Exception) and has a CVSS 3.1 base score of 7.9, indicating high severity. The issue is resolved in version 4.5.128.
Potential Impact
An attacker can bypass the human-in-the-loop safety mechanism by adding dangerous tools to the approval allowlist without authentication, potentially leading to unauthorized execution of harmful commands or actions within the PraisonAI system. This compromises the integrity and safety controls of the multi-agent system, increasing risk of misuse or damage. There are no known exploits in the wild at this time.
Mitigation Recommendations
This vulnerability is fixed in PraisonAI version 4.5.128. Users should upgrade to version 4.5.128 or later to remediate this issue. Until upgraded, ensure that an auth_token is configured to prevent unauthenticated access to the /api/approval/allow-list endpoint. Patch status is not explicitly stated beyond the fix in 4.5.128; verify with vendor advisories for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-09T19:31:56.013Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d843771cc7ad14da3fb5c3
Added to database: 4/10/2026, 12:25:27 AM
Last enriched: 4/17/2026, 12:02:35 PM
Last updated: 5/25/2026, 12:22:36 PM
Views: 83
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.