# CVE-2026-56838: PraisonAI recipe streaming bypasses dangerous tool policy check

Source: https://junglewise.ai/threats/cve-2026-56838-praisonai-recipe-run-stream-skips-dangerous-tool-policy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-56838 · Severity: high · CVSS 7.8 · Published 2026-10-23

PraisonAI is a multi-agent system that executes recipes—workflows that can invoke potentially dangerous tools like command execution. The product normally blocks dangerous tools unless explicitly enabled, but the streaming execution path skips this safety check entirely. An attacker or authorized user running recipes in streaming mode can execute commands with PraisonAI's privileges without proper approval, leading to system compromise.

Technologies: [MervinPraison PraisonAI](https://junglewise.ai/threats/technologies/mervinpraison-praisonai), [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai). Vendors: [MervinPraison](https://junglewise.ai/threats/vendors/mervinpraison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-56838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56838 being exploited in the wild.

**How severe is CVE-2026-56838?** High severity, with a CVSS score of 7.8, published 23 October 2026.

**Which products and versions are affected?** MervinPraison PraisonAI 4.5.87 to before 4.6.59; praisonai (PyPI) ECOSYSTEM:introduced=4.5.87,fixed=4.6.59.

**Is there a fix for CVE-2026-56838?** Yes. praisonai (PyPI): upgrade to 4.6.59 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56838 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-56838?** Check whether you run MervinPraison PraisonAI or praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonai (PyPI): upgrade to 4.6.59 or later

  ```sh
  pip install "praisonai>=4.6.59"
  ```


## Technical details

The vulnerability is an authorization bypass in recipe execution: recipe.run() enforces dangerous-tool policy via _check_tool_policy() before execution, but recipe.run_stream() calls _execute_recipe() directly without this check. An attacker who can invoke the streaming API endpoint /v1/recipes/stream or the CLI --stream flag can load a recipe declaring execute_command in its tool requirements and bypass the allow_dangerous_tools=False default, reaching the execution engine with dangerous tools enabled. The fix patches version 4.6.59 to enforce the same policy gate in both execution paths.

## Affected products

- MervinPraison PraisonAI 4.5.87 to before 4.6.59

## Identifiers

- CVE-2026-56838
- GHSA-v847-hxxw-3pxg
- PYSEC-2026-3520

## Timeline

- 2026-06-17: disclosed
- 2026-06-17: patched

## References

- [https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v847-hxxw-3pxg](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v847-hxxw-3pxg)

## Related threats

- [PraisonAI authentication bypass in A2U event streaming](https://junglewise.ai/threats/cve-2026-57146-praisonai-a2u-incomplete-authentication-fix-leaves-current-serve)
- [PraisonAI sandbox escape when Landlock unavailable](https://junglewise.ai/threats/cve-2026-57144-praisonai-sandlocksandbox-falls-back-to-unrestricted-subprocess)
- [PraisonAI recipe policy bypass via YAML-approved tools](https://junglewise.ai/threats/cve-2026-57142-praisonai-recipe-workflow-policy-can-be-bypassed-by-declaring-and)
- [PraisonAI shell command injection in compute-bridged file tools](https://junglewise.ai/threats/cve-2026-57117-praisonai-compute-bridged-file-tools-allow-shell-command)
- [PraisonAI AgentOS authentication bypass in FastAPI deployment](https://junglewise.ai/threats/cve-2026-57116-praisonai-agentos-remains-unauthenticated-after-incomplete-fix)