Is CVE-2026-56838 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56838 being exploited in the wild.

How severe is CVE-2026-56838?

High severity, with a CVSS score of 7.8, published 23 October 2026.

Which products and versions are affected?

MervinPraison PraisonAI 4.5.87 to before 4.6.59; praisonai (PyPI) ECOSYSTEM:introduced=4.5.87,fixed=4.6.59.

Is there a fix for CVE-2026-56838?

Yes. praisonai (PyPI): upgrade to 4.6.59 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56838 attacked?

It is attacked with local access or over the network, in a software library.

Am I affected by CVE-2026-56838?

Check whether you run MervinPraison PraisonAI or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56838: PraisonAI recipe streaming bypasses dangerous tool policy check

CVE-2026-56838 · Severity: high · CVSS 7.8 · Published 2026-10-23

PraisonAI is a multi-agent system that executes recipes—workflows that can invoke potentially dangerous tools like command execution. The product normally blocks dangerous tools unless explicitly enabled, but the streaming execution path skips this safety check entirely. An attacker or authorized user running recipes in streaming mode can execute commands with PraisonAI's privileges without proper approval, leading to system compromise.

Technologies: MervinPraison PraisonAI, praisonai (PyPI). Vendors: MervinPraison, PyPI.

Quick answers

Is CVE-2026-56838 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56838 being exploited in the wild.
How severe is CVE-2026-56838?: High severity, with a CVSS score of 7.8, published 23 October 2026.
Which products and versions are affected?: MervinPraison PraisonAI 4.5.87 to before 4.6.59; praisonai (PyPI) ECOSYSTEM:introduced=4.5.87,fixed=4.6.59.
Is there a fix for CVE-2026-56838?: Yes. praisonai (PyPI): upgrade to 4.6.59 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56838 attacked?: It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2026-56838?: Check whether you run MervinPraison PraisonAI or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

praisonai (PyPI): upgrade to 4.6.59 or later
```
pip install "praisonai>=4.6.59"
```

Technical details

The vulnerability is an authorization bypass in recipe execution: recipe.run() enforces dangerous-tool policy via _check_tool_policy() before execution, but recipe.run_stream() calls _execute_recipe() directly without this check. An attacker who can invoke the streaming API endpoint /v1/recipes/stream or the CLI --stream flag can load a recipe declaring execute_command in its tool requirements and bypass the allow_dangerous_tools=False default, reaching the execution engine with dangerous tools enabled. The fix patches version 4.6.59 to enforce the same policy gate in both execution paths.

Affected products

MervinPraison PraisonAI 4.5.87 to before 4.6.59

Identifiers

CVE-2026-56838
GHSA-v847-hxxw-3pxg
PYSEC-2026-3520

Timeline

2026-06-17: disclosed
2026-06-17: patched

References

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v847-hxxw-3pxg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.