CVE-2026-55530: CWE-862: Missing Authorization in MervinPraison PraisonAI
Description
CVE-2026-55530 is a missing authorization vulnerability in MervinPraison's PraisonAI multi-agent teams system. Before version 1.6.58, the ast_grep_rewrite tool did not enforce the required approval decorator, allowing an agent-controlled call with dry_run=False to perform broad file rewrites without proper authorization. This issue is fixed in version 1.6.58.
CVSS v3.1
Score 6.1medium
Affected software
MervinPraison
PraisonAI
MervinPraison
praisonaiagents
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PraisonAI versions prior to 1.6.58 contain a missing authorization control in the ast_grep_rewrite mutation tool. Unlike sibling tools, ast_grep_rewrite lacked the @require_approval decorator, enabling an agent-controlled call with the parameter dry_run=False to pass the --update-all flag and specify broad paths for rewriting matching files without passing the expected authorization gate. This could lead to unauthorized file modifications. The vulnerability is addressed in PraisonAI version 1.6.58.
Potential Impact
The vulnerability allows unauthorized agents to perform broad file rewrite operations without the necessary approval, potentially leading to unauthorized modifications of files. The CVSS score of 6.1 (medium severity) reflects the limited attack vector (local) and required user interaction, with no confidentiality impact but high integrity impact and low availability impact.
Mitigation Recommendations
Upgrade PraisonAI to version 1.6.58 or later, where the missing authorization check in ast_grep_rewrite has been implemented. No other mitigation is indicated as the issue is fixed in this version.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T23:01:04.073Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a8dac49acd9273b49556909
Added to database: 08/25/2026, 14:52:57 UTC
Last enriched: 09/10/2026, 18:25:23 UTC
Last updated: 10/08/2026, 18:48:46 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.