Executive brief
PraisonAI, a system for managing multi-agent AI teams, contains a security flaw that allows unauthorized access to sensitive files. Due to an incomplete fix for a previous vulnerability, an attacker can bypass directory restrictions to read any file the system has access to, such as passwords, private SSH keys, or cloud credentials. This could lead to a full compromise of the host system or connected cloud environments.
Technical details
The vulnerability exists because the fix for CVE-2026-44336 failed to address all vulnerable handlers in `mcp_server/adapters/cli_tools.py`. Specifically, `workflow.show`, `workflow.validate`, and `deploy.validate` remained unprotected by path resolution helpers, allowing for path traversal. Additionally, the dispatcher in `server.py` fails to enforce schema validation on `**kwargs` passed from MCP `tools/call` arguments. An unauthenticated attacker can exploit these handlers via the HTTP or stdio transports to read arbitrary files (e.g., `/etc/passwd`, `.env` files) that the host user has permission to access. The issue is resolved in version 4.6.40.
Affected products
- MervinPraison PraisonAI < 4.6.40
Timeline
- 2026-05-19: patched: Fix merged in PR #1684
- 2026-07-21: advisory: GHSA-9cr9-25q5-8prj published