Is CVE-2026-56074 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56074 being exploited in the wild.

How severe is CVE-2026-56074?

Medium severity, with a CVSS score of 5.5, published 18 June 2026.

Which products and versions are affected?

praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.128.

Is there a fix for CVE-2026-56074?

Yes. praisonaiagents (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56074 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-56074?

Check whether you run MervinPraison PraisonAI Agents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56074: MervinPraison PraisonAI tool approval cache bypass in praisonaiagents

CVE-2026-56074 · Severity: medium · CVSS 5.5 · Published 2026-06-18

PraisonAI, a framework for AI agents, contains a security flaw in how it handles user permission for running system commands. When a user approves a single safe command (like listing files), the system mistakenly remembers that approval for all future commands in that session. This allows an AI agent—potentially manipulated by a malicious prompt—to silently run dangerous commands to steal sensitive data like API keys and passwords without the user's knowledge.

Technologies: MervinPraison PraisonAI Agents, praisonaiagents (PyPI). Vendors: MervinPraison, PyPI.

Quick answers

Is CVE-2026-56074 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56074 being exploited in the wild.
How severe is CVE-2026-56074?: Medium severity, with a CVSS score of 5.5, published 18 June 2026.
Which products and versions are affected?: praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.128.
Is there a fix for CVE-2026-56074?: Yes. praisonaiagents (PyPI): upgrade to 4.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56074 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-56074?: Check whether you run MervinPraison PraisonAI Agents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonaiagents (PyPI): upgrade to 4.5.128 or later
```
pip install "praisonaiagents>=4.5.128"
```

Technical details

The vulnerability exists in the 'require_approval' decorator within the PraisonAI Agents approval system. The system caches approval status using only the tool name (e.g., 'execute_command') as the key, failing to include the specific invocation arguments in the cache lookup. Consequently, once a user provides manual consent for a benign command, all subsequent calls to that tool are automatically authorized for the remainder of the execution context. An attacker can leverage this via prompt injection to first request a harmless command and then silently execute shell commands to exfiltrate process environment variables (such as OPENAI_API_KEY) which are passed to subprocesses via 'os.environ.copy()'. The issue is addressed in version 1.5.128.

Affected products

MervinPraison PraisonAI (praisonaiagents) < 1.5.128

Identifiers

CVE-2026-56074
GHSA-ffp3-3562-8cv3
PYSEC-2026-2946

Timeline

2026-04-09: advisory: GitHub Security Advisory published
2026-06-18: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.