Reserved but Public CVEs

CVE-2026-57118 is an improper authentication vulnerability in PraisonAI praisonaiagents affecting the HTTP endpoints exposed by AgentTeam.launch() and Agents.launch(). When these launch functions are used to expose agent services over the network, externally reachable endpoints permit unauthenticated clients to list deployed agents and invoke team-level or per-agent execution functionality. The issue stems from network-facing functionality being exposed without requiring authentication, allowing remote parties to interact with agent orchestration features that should be access-controlled.

CVE-2026-57118First seen Jul 21, 2026

CVE-2026-57441 is a path filtering vulnerability in the @bitbonsai/mcpvault package affecting PathFilter restricted-directory enforcement. The flaw arises from improper handling of case-insensitive filename matching and Windows path equivalence rules for trailing dots and spaces during deny-list checks. On case-insensitive filesystems, an attacker can supply path variants that evade restricted-directory matching and thereby access directories intended to be blocked, including sensitive project metadata and dependency directories. The vulnerability affects deny-list enforcement for file operations such as reading, writing, moving, searching, and directory listing. The vault-root containment check preventing traversal outside the vault using parent-directory references was not affected.

CVE-2026-57441First seen Jul 21, 2026

CVE-2026-57121 is an improper authorization vulnerability in PraisonAI Platform affecting versions starting at 0.1.4 and fixed in 0.1.6. The API's DELETE endpoints fail to enforce ownership or privileged-role authorization checks, allowing any authenticated workspace member to delete resources created by other workspace members or by the workspace owner. Affected resource types include projects, agents, issues, labels, issue dependencies, and issue-label attachments. The flaw stems from missing server-side validation that the requester is either the resource owner or holds an administrative role before destructive actions are permitted.

CVE-2026-57121First seen Jul 21, 2026

CVE-2026-57119 is an unauthenticated local file inclusion vulnerability in the PraisonAI Jobs API affecting versions prior to 4.6.59. The flaw is exposed through the job submission functionality, where the agent_file parameter can be supplied with an arbitrary filesystem path. Insufficient validation of this parameter allows an attacker to cause the application to include or read local files accessible to the server process. This can expose sensitive application and host data without authentication.

CVE-2026-57119First seen Jul 21, 2026

CVE-2026-57134 is an authentication bypass vulnerability in the npm package praisonai affecting the exported MCPSecurity helper. When MCPSecurity is used to protect MCP HTTP transports, gateways, or similar endpoints, the implementation improperly accepts invalid Basic and OAuth credentials without performing effective validation. As a result, any non-empty Authorization header may be treated as sufficient for authentication when those modes are configured. The flaw affects access-control enforcement at the authentication layer rather than a specific memory-safety condition, and can expose protected tools, resources, workflows, and actions to unauthorized users.

CVE-2026-57134First seen Jul 21, 2026

CVE-2026-56834 is an arbitrary file read vulnerability in PraisonAI Dynamic Context Discovery artifact tools. The flaw allows artifact operations to access host files outside the configured artifact storage boundary when an attacker can influence artifact tool arguments. The vulnerable design relies on raw filesystem path handling rather than strict artifact identifier resolution and insufficiently enforces containment within the configured artifact store base directory. Affected artifact helper operations include file access and content inspection functions such as load, head, tail, grep, chunk, and delete unless equivalent validation is applied. Successful exploitation enables unauthorized reading of local files accessible to the PraisonAI process, resulting in exposure of sensitive data from the host environment.

CVE-2026-56834First seen Jul 21, 2026

CVE-2026-56838 is a policy enforcement flaw in PraisonAI in which recipe.run_stream() does not apply the dangerous-tool restrictions enforced by recipe.run(). As a result, recipes executed through the streaming code path can declare and invoke dangerous tools, including command-execution capabilities, despite the default denial model intended to block such use. The issue stems from inconsistent security checks between non-streaming and streaming execution paths, allowing the streaming interface to bypass the intended preflight validation and authorization boundary for dangerous tools.

CVE-2026-56838First seen Jul 21, 2026

CVE-2026-57210 is an IP spoofing vulnerability in Heimdall caused by insufficient validation of client-supplied Forwarded and X-Forwarded-For headers when trusted_proxies is configured. Under affected configurations, malformed or attacker-controlled header values can be accepted into client IP address handling and used to populate Request.ClientIPAddresses. This can influence rule evaluation that relies on client IP information and, in proxy mode, can also cause spoofed or malformed client IP data to be propagated to upstream services.

CVE-2026-57210First seen Jul 21, 2026

CVE-2026-57112 is a DNS rebinding vulnerability in the legacy Server-Sent Events (SSE) MCP server transport used by PraisonAI. The vulnerable implementation accepts attacker-controlled Host and Origin headers without authentication or adequate origin validation, allowing a malicious web origin to reach a locally exposed or internally reachable MCP server. Through DNS rebinding, an attacker can cause a victim's browser to communicate with the legacy SSE endpoints and interact with registered MCP tools as the local user. The issue affects the legacy SSE transport path and stems from missing or insufficient validation of trusted origins and hosts on the relevant HTTP endpoints.

CVE-2026-57112First seen Jul 21, 2026

CVE-2026-57144 is a sandbox enforcement flaw in PraisonAI SandlockSandbox in which the native sandbox can fail open when Linux Landlock support is unavailable or unusable. Instead of refusing execution when the required isolation mechanism cannot be applied, the component permits subprocess execution in a degraded state without the intended filesystem and network restrictions. As a result, code that is expected to run inside a constrained sandbox may execute with the ambient privileges of the hosting user or process, bypassing configured path restrictions and network controls.

CVE-2026-57144First seen Jul 21, 2026

CVE-2026-57137 is an approval-bypass vulnerability in the npm praisonai package affecting the TypeScript AgentLoop implementation. In affected versions, applications that use createAgentLoop() and treat the documented onToolCall callback as a human-review or policy-enforcement gate are exposed because the callback is invoked only after the requested tool has already executed. This creates a logic flaw in the approval workflow: tool execution occurs before the intended authorization decision is made. As a result, any registered tool reachable through the agent loop may perform actions before a denial can be processed, defeating the expected pre-execution control boundary.

CVE-2026-57137First seen Jul 21, 2026

CVE-2026-57138 is a sandbox escape vulnerability in the npm package praisonai affecting the codeMode tool. The implementation relies on attacker-controlled JavaScript being executed in a purported sandbox, but the sandbox can be bypassed through use of the JavaScript Function constructor, allowing access to the host Node.js process. Because the untrusted code can escape the intended execution boundary, the issue effectively turns codeMode into arbitrary host-process JavaScript execution rather than isolated evaluation.

CVE-2026-57138First seen Jul 21, 2026

CVE-2026-57136 is an allowlist bypass vulnerability in the npm praisonai package affecting SandboxExecutor and CommandValidator logic. The vulnerable design validates only the first whitespace-delimited token of a supplied command string against an allowedCommands policy, but subsequently executes the entire untrusted string through a shell interpreter using a shell-string execution path. This mismatch allows an attacker to prepend an allowed command token and then append shell metacharacters or chained commands, bypassing the intended command restriction. As a result, command validation can be defeated and arbitrary shell commands can be executed in the security context of the PraisonAI process.

CVE-2026-57136First seen Jul 21, 2026

CVE-2026-57146 is an authentication flaw in PraisonAI A2U affecting deployments started with the documented `praisonai serve a2u` command. An incomplete prior fix leaves A2U subscription and event-related routes unauthenticated by default unless the `A2U_AUTH_TOKEN` environment variable is explicitly configured. As a result, a reachable A2U server may permit unauthenticated access to A2U information and event-stream functionality. The issue stems from missing authentication enforcement on exposed A2U routes rather than a credential bypass after successful login.

CVE-2026-57146First seen Jul 21, 2026

CVE-2026-57123 is an exposure in PraisonAI praisonaiagents where the MCP SSE transport binds to all network interfaces by default and does not enforce authentication or Origin validation. This creates a network-reachable endpoint through which remote parties can enumerate and invoke registered MCP tools without prior authentication. The absence of Origin validation also introduces cross-origin abuse risk, including DNS rebinding scenarios against localhost-exposed instances. The vulnerable condition stems from insecure default network exposure combined with missing access control on the tool-execution interface.

CVE-2026-57123First seen Jul 21, 2026

CVE-2026-57122 is an authentication and integrity validation flaw in PraisonAI webhook handling for integrations such as WhatsApp and Linear. When the relevant webhook secret is unset, the application skips signature verification instead of rejecting the request. This fail-open behavior causes inbound webhook payloads to be treated as trusted even though no cryptographic authenticity check has been performed. As a result, an attacker able to reach the exposed webhook endpoint can forge webhook events and have them processed as legitimate platform-originated messages or actions.

CVE-2026-57122First seen Jul 21, 2026

CVE-2026-57125 is an unauthenticated remote code execution vulnerability in PraisonAI affecting the Jobs API. The issue is caused by missing authentication on the job submission interface and an approval bypass in which an attacker-controlled `approve` field in YAML workflow content can pre-authorize dangerous tools. In vulnerable deployments, an attacker can submit crafted jobs to the `/api/v1/runs` workflow execution path and cause execution of operating system commands through exposed tool functionality such as command execution features. The vulnerability combines improper access control on the API with unsafe trust in user-supplied approval metadata, enabling remote attackers to reach privileged execution paths without credentials or operator approval.

CVE-2026-57125First seen Jul 21, 2026

CVE-2026-57126 is a server-side request forgery vulnerability in praisonaiagents caused by incomplete SSRF validation logic. The protection checks only literal IP address encodings and does not resolve and validate DNS hostnames before issuing outbound requests. As a result, an attacker can supply a hostname that resolves to a prohibited destination such as loopback, private, link-local, or cloud metadata address space and bypass the intended network restrictions. The issue affects URL-fetching functionality including scrape_page, crawl, extract_links, extract_text, and URL mention fetching paths. Proper remediation requires resolving hostnames, validating every resolved address against blocked ranges, and pinning the connection to the validated address to prevent DNS rebinding.

CVE-2026-57126First seen Jul 21, 2026

CVE-2026-56837 is an authentication flaw in PraisonAI LinearBot in which webhook requests are processed without signature verification when the LINEAR_WEBHOOK_SECRET configuration is absent. In affected deployments, forged Linear webhook events can be accepted and dispatched into the agent workflow instead of being rejected. The vulnerability stems from failing open on missing webhook authentication material, allowing untrusted network input to be treated as authentic webhook traffic.

CVE-2026-56837First seen Jul 21, 2026

CVE-2026-57128 is an authentication flaw in the SSE server component of PraisonAI praisonaiagents. The `/publish` endpoint does not enforce authentication, allowing an unauthenticated party with network access to the SSE service to submit arbitrary events for broadcast to connected Server-Sent Events clients. The `/info` endpoint also lacks authentication, exposing server configuration details and connected client counts. The issue affects deployments where the SSE server is reachable by an attacker, particularly if it is exposed beyond the default localhost binding. Successful exploitation enables unauthorized event injection into the application’s event stream and information disclosure useful for follow-on activity.

CVE-2026-57128First seen Jul 21, 2026

CVE-2026-57113 is a path traversal vulnerability in PraisonAI's handling of GitHub template cache paths. Crafted GitHub template reference components are incorporated into filesystem paths without sufficient validation or confinement to the intended cache root. As a result, attacker-controlled template owner, repository, path, or ref values can cause path resolution outside the template cache directory. The flaw allows writing cache metadata outside the cache boundary and, when a normal cache entry already exists for the same owner/repository/template prefix, can also trigger deletion of an attacker-selected directory reachable by the PraisonAI process. The vulnerability affects workflows that load attacker-supplied or otherwise untrusted GitHub template URIs.

CVE-2026-57113First seen Jul 21, 2026

CVE-2026-56832 is an authorization flaw in PraisonAI's DiscordApproval backend in which unrelated subsequent channel messages, including simple affirmative responses such as "yes," can be accepted as approval for a pending dangerous tool invocation. The approval logic does not sufficiently bind an approval response to the specific request that initiated it and does not adequately enforce that the approving message originates from an authorized approver for that request. As a result, approval of sensitive actions can be inferred from unrelated channel activity rather than from an authenticated, request-specific authorization event.

CVE-2026-56832First seen Jul 21, 2026

CVE-2026-57133 is a command injection vulnerability in the npm package praisonai affecting the utility-tools shell helper. The vulnerable design relies on an allowlist check applied to a string command interface, but the protection can be bypassed when an attacker supplies an allowed initial token followed by shell chaining syntax. Because the helper executes the resulting string through a shell, metacharacters and command separators can cause additional attacker-controlled commands to be interpreted and run beyond the intended allowlisted operation. The issue stems from validating a policy-checked command string rather than enforcing execution of a specific executable and argument list.

CVE-2026-57133First seen Jul 21, 2026

CVE-2026-57140 is an improper authentication vulnerability in the npm package praisonai AgentOS. A remotely reachable TypeScript AgentOS service exposes HTTP endpoints that allow unauthenticated users to enumerate configured agents and invoke them without credentials. Specifically, the vulnerable behavior permits disclosure of agent metadata, including names, roles, and instruction prefixes, and allows direct interaction with configured agents through exposed API functionality. The issue stems from missing or insufficient authentication enforcement on non-health application routes in deployments where the service is reachable by attackers.

CVE-2026-57140First seen Jul 21, 2026

CVE-2026-57442 is a path restriction flaw in MCPVault affecting the npm package @bitbonsai/mcpvault. The vulnerable PathFilter logic restricted access to sensitive directory names such as .git, .obsidian, and node_modules only when those directories appeared at the vault root. As a result, the filter failed to block the same restricted directory names when they appeared deeper in the directory hierarchy, allowing traversal into nested sensitive directories that should have been excluded from agent access and indexing.

CVE-2026-57442First seen Jul 21, 2026