Is CVE-2026-40159 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40159 being exploited in the wild.

How severe is CVE-2026-40159?

Medium severity, with a CVSS score of 5.5, published 10 April 2026.

Which products and versions are affected?

praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.128.

Is there a fix for CVE-2026-40159?

Yes. praisonai (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40159 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-40159?

Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40159: MervinPraison PraisonAI sensitive information exposure in MCP integration

CVE-2026-40159 · Severity: medium · CVSS 5.5 · Published 2026-04-10

PraisonAI, an AI agent framework, contains a security flaw in how it handles background tasks. When the software runs third-party tools or servers, it inadvertently shares all of the main application's secret keys and credentials with those tools. This could allow a malicious third-party package to steal sensitive information like OpenAI API keys, database passwords, or cloud access tokens.

Technologies: Praisonai, praisonai (PyPI). Vendors: Praison, PyPI.

Quick answers

Is CVE-2026-40159 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40159 being exploited in the wild.
How severe is CVE-2026-40159?: Medium severity, with a CVSS score of 5.5, published 10 April 2026.
Which products and versions are affected?: praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.128.
Is there a fix for CVE-2026-40159?: Yes. praisonai (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40159 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-40159?: Check whether you run Praisonai or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonai (PyPI): upgrade to 4.5.128 or later
```
pip install "praisonai>=4.5.128"
```

Technical details

PraisonAI's Model Context Protocol (MCP) integration uses Python's subprocess module to spawn background servers. By default, the implementation in `mcp.py` copies the entire parent process environment (`os.environ.copy()`) and forwards it to the child process if no specific environment is provided. An attacker can exploit this by providing a malicious command string to the MCP constructor. When executed, the subprocess inherits all sensitive environment variables, such as `OPENAI_API_KEY` or database connection strings, which can then be exfiltrated to a remote server. This vulnerability is tracked as CVE-2026-40159 and is fixed in version 4.5.128.

Affected products

MervinPraison PraisonAI < 4.5.128

Identifiers

CVE-2026-40159
GHSA-pj2r-f9mw-vrcq
PYSEC-2026-2918

Timeline

2026-04-09: disclosed: Vulnerability published by MervinPraison
2026-04-10: advisory: GitHub Advisory GHSA-pj2r-f9mw-vrcq published
2026-04-10: patched: Fixed in version 4.5.128

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.