# CVE-2026-56832: PraisonAI DiscordApproval dangerous tool authorization bypass

Source: https://junglewise.ai/threats/cve-2026-56832-praisonai-discordapproval-accepts-unrelated-channel-messages-as  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-56832 · Severity: high · CVSS 8.8 · Published 2026-10-23

PraisonAI is a multi-agent system that uses Discord for approving high-risk operations like file deletion or command execution. The approval mechanism fails to verify that approval messages are actually intended for the pending request, allowing any user in the Discord channel to approve any pending dangerous tool call by simply posting "yes". An attacker with write access to the approval channel can trigger unauthorized code execution or data modification at the PraisonAI process's privilege level.

Technologies: [MervinPraison PraisonAI](https://junglewise.ai/threats/technologies/mervinpraison-praisonai), [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai). Vendors: [MervinPraison](https://junglewise.ai/threats/vendors/mervinpraison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-56832 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56832 being exploited in the wild.

**How severe is CVE-2026-56832?** High severity, with a CVSS score of 8.8, published 23 October 2026.

**Which products and versions are affected?** MervinPraison PraisonAI 4.5.2 to 4.6.58; praisonai (PyPI) ECOSYSTEM:introduced=4.5.2,fixed=4.6.59.

**Is there a fix for CVE-2026-56832?** Yes. praisonai (PyPI): upgrade to 4.6.59 or later. Until then: Do not use DiscordApproval for high-risk tool authorization in channels with untrusted members. Restrict write access to the configured approval channel to only trusted approvers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56832 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56832?** Check whether you run MervinPraison PraisonAI or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonai (PyPI): upgrade to 4.6.59 or later

  ```sh
  pip install "praisonai>=4.6.59"
  ```


Do not use DiscordApproval for high-risk tool authorization in channels with untrusted members. Restrict write access to the configured approval channel to only trusted approvers.

## Technical details

The DiscordApproval backend polls channel history for messages after the approval request and approves any non-bot message containing approval keywords like "yes" or "approve", without binding the approval to a Discord reply, thread, specific message ID, or approver allowlist. An attacker can post "yes" in the configured approval channel at any time to approve pending dangerous tool calls. The Slack and Telegram backends have similar issues but lack explicit approver validation across all messaging backends.

## Affected products

- MervinPraison PraisonAI 4.5.2 to 4.6.58

## Identifiers

- CVE-2026-56832
- GHSA-8579-rgg5-ph2m
- PYSEC-2026-3506

## Timeline

- 2026-06-17: disclosed
- 2026-06-17: patched: Version 4.6.59

## References

- [https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2m](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2m)

## Related threats

- [PraisonAI authentication bypass in A2U event streaming](https://junglewise.ai/threats/cve-2026-57146-praisonai-a2u-incomplete-authentication-fix-leaves-current-serve)
- [PraisonAI sandbox escape when Landlock unavailable](https://junglewise.ai/threats/cve-2026-57144-praisonai-sandlocksandbox-falls-back-to-unrestricted-subprocess)
- [PraisonAI recipe policy bypass via YAML-approved tools](https://junglewise.ai/threats/cve-2026-57142-praisonai-recipe-workflow-policy-can-be-bypassed-by-declaring-and)
- [PraisonAI shell command injection in compute-bridged file tools](https://junglewise.ai/threats/cve-2026-57117-praisonai-compute-bridged-file-tools-allow-shell-command)
- [PraisonAI AgentOS authentication bypass in FastAPI deployment](https://junglewise.ai/threats/cve-2026-57116-praisonai-agentos-remains-unauthenticated-after-incomplete-fix)