CVE-2026-55530: PraisonAI Agents missing authz lets

Q: Is CVE-2026-55530 actively exploited?

No confirmed active exploitation of CVE-2026-55530 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55530?

Upgrade praisonaiagents to 1.6.58 or later immediately — this is a direct code fix (commit 2f9677a) adding the missing @require_approval decorator, not a config workaround. Until patched, audit which agents/tools in your PraisonAI deployment have access to ast_grep_rewrite and restrict or remove it from agent toolsets that don't strictly require bulk code-rewrite capability. Where the tool must remain enabled, enforce dry_run=True by policy at the orchestration layer and add an external approval/human-in-the-loop check before allowing --update-all or broad-path invocations. For detection, log and alert on ast_grep_rewrite invocations with dry_run=False and --update-all, and monitor git/file-integrity diffs for unexpected bulk changes correlated with agent task runs.

Q: What systems are affected by CVE-2026-55530?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI-assisted code generation/refactoring pipelines.

Q: What is the CVSS score for CVE-2026-55530?

CVE-2026-55530 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.17%.

CISO Take

PraisonAI's ast_grep_rewrite tool — a mutation capability that lets an agent programmatically rewrite source files — shipped without the @require_approval decorator that every sibling mutation tool enforces, so when invoked with dry_run=False, --update-all and a broad path, it rewrites all matching files with no human authorization gate in the loop. This matters because PraisonAI is a multi-agent orchestration framework with roughly 20 downstream dependents; any agent workflow (including one steered by untrusted task input or indirect prompt injection) can trigger bulk, unreviewed code changes across a project. There's no public exploit, no CISA KEV listing, and EPSS data isn't available, and exploitation requires local access plus some user interaction (CVSS 6.1, AV:L/UI:R), so this isn't a remote, drive-by threat — but the CWE-862 Missing Authorization gap is exactly the class of flaw that turns "helpful autonomous agent" into "agent silently overwrites your codebase." Patch to praisonaiagents 1.6.58 immediately, and until then audit any workflow granting agents ast_grep_rewrite or similar mutation tools, disabling dry_run bypass where possible. Detection-wise, monitor for unexpected bulk file modifications correlated with agent task execution logs, especially --update-all invocations outside change-managed windows.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium severity (CVSS 6.1) reflects a real but bounded risk: exploitation requires local access to the agent environment and some user interaction to trigger the flawed tool path, capping the attack vector at AV:L/UI:R. However, impact is meaningful — Integrity:High and Availability:Low reflect that arbitrary matching files can be rewritten without authorization, which in an agentic coding/DevOps context can corrupt source trees, inject unwanted changes, or silently break builds. No public exploit or scanner template exists and it's not in CISA KEV, so opportunistic mass exploitation is unlikely; the realistic risk is a malicious or manipulated agent task (e.g., via indirect prompt injection or a compromised upstream instruction) abusing the tool internally rather than an external network attacker.

How does the attack unfold?

Agent tool invocation

An agent within a PraisonAI multi-agent team is induced (via task input, upstream data, or manipulated instructions) to call the ast_grep_rewrite tool.

AML.T0053

Approval gate bypass

The call is made with dry_run=False, --update-all, and a broad path; because ast_grep_rewrite lacks the @require_approval decorator present on sibling mutation tools, no authorization check intercepts it.

Mass file rewrite

Matching files across the target path are rewritten in bulk without human review, corrupting or altering source content unexpectedly.

AML.T0101

Downstream integrity impact

Unreviewed rewritten code may be committed, deployed, or executed downstream, propagating the unauthorized change into the broader software supply chain.

Agent tool invocation

An agent within a PraisonAI multi-agent team is induced (via task input, upstream data, or manipulated instructions) to call the ast_grep_rewrite tool.

AML.T0053

Approval gate bypass

The call is made with dry_run=False, --update-all, and a broad path; because ast_grep_rewrite lacks the @require_approval decorator present on sibling mutation tools, no authorization check intercepts it.

Mass file rewrite

Matching files across the target path are rewritten in bulk without human review, corrupting or altering source content unexpectedly.

AML.T0101

Downstream integrity impact

Unreviewed rewritten code may be committed, deployed, or executed downstream, propagating the unauthorized change into the broader software supply chain.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI Agents	pip	< 1.6.58	`1.6.58`
20 dependents63% patched~21d to patchFull package profile →

Do you use PraisonAI Agents? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVLocal

ACLow

PRNone

UIRequired

SUnchanged

CNone

IHigh

ALow

What should I do?

1 step

Upgrade praisonaiagents to 1.6.58 or later immediately — this is a direct code fix (commit 2f9677a) adding the missing @require_approval decorator, not a config workaround. Until patched, audit which agents/tools in your PraisonAI deployment have access to ast_grep_rewrite and restrict or remove it from agent toolsets that don't strictly require bulk code-rewrite capability. Where the tool must remain enabled, enforce dry_run=True by policy at the orchestration layer and add an external approval/human-in-the-loop check before allowing --update-all or broad-path invocations. For detection, log and alert on ast_grep_rewrite invocations with dry_run=False and --update-all, and monitor git/file-integrity diffs for unexpected bulk changes correlated with agent task runs.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionAgentFrameworkAML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0101- Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 14-Human oversight

ISO 42001

Annex A.6.2-AI system operational use and oversight

NIST AI RMF

GOVERN 1.2-Accountability and oversight mechanisms

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-55530?

PraisonAI's ast_grep_rewrite tool — a mutation capability that lets an agent programmatically rewrite source files — shipped without the @require_approval decorator that every sibling mutation tool enforces, so when invoked with dry_run=False, --update-all and a broad path, it rewrites all matching files with no human authorization gate in the loop. This matters because PraisonAI is a multi-agent orchestration framework with roughly 20 downstream dependents; any agent workflow (including one steered by untrusted task input or indirect prompt injection) can trigger bulk, unreviewed code changes across a project. There's no public exploit, no CISA KEV listing, and EPSS data isn't available, and exploitation requires local access plus some user interaction (CVSS 6.1, AV:L/UI:R), so this isn't a remote, drive-by threat — but the CWE-862 Missing Authorization gap is exactly the class of flaw that turns "helpful autonomous agent" into "agent silently overwrites your codebase." Patch to praisonaiagents 1.6.58 immediately, and until then audit any workflow granting agents ast_grep_rewrite or similar mutation tools, disabling dry_run bypass where possible. Detection-wise, monitor for unexpected bulk file modifications correlated with agent task execution logs, especially --update-all invocations outside change-managed windows.

Is CVE-2026-55530 actively exploited?

No confirmed active exploitation of CVE-2026-55530 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55530?

Upgrade praisonaiagents to 1.6.58 or later immediately — this is a direct code fix (commit 2f9677a) adding the missing @require_approval decorator, not a config workaround. Until patched, audit which agents/tools in your PraisonAI deployment have access to ast_grep_rewrite and restrict or remove it from agent toolsets that don't strictly require bulk code-rewrite capability. Where the tool must remain enabled, enforce dry_run=True by policy at the orchestration layer and add an external approval/human-in-the-loop check before allowing --update-all or broad-path invocations. For detection, log and alert on ast_grep_rewrite invocations with dry_run=False and --update-all, and monitor git/file-integrity diffs for unexpected bulk changes correlated with agent task runs.

What systems are affected by CVE-2026-55530?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, AI-assisted code generation/refactoring pipelines.

What is the CVSS score for CVE-2026-55530?

CVE-2026-55530 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationAI-assisted code generation/refactoring pipelines

MITRE ATLAS Techniques

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0101Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 14

ISO 42001: Annex A.6.2

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval decorator used by sibling mutation tools. With dry_run=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected authorization gate. This issue is fixed in version 1.6.58.

Exploitation Scenario

An attacker seeds a task description, ingested document, or upstream tool output with instructions designed to manipulate an agent's reasoning (e.g., indirect prompt injection embedded in a code comment or ticket the agent is asked to process). The manipulated agent, operating within a PraisonAI multi-agent team with access to ast_grep_rewrite, calls the tool with dry_run=False, --update-all, and a broad path — and because the approval decorator is missing, the call executes without the authorization prompt a human reviewer would normally see. The result is unauthorized, bulk rewriting of matching source files across the project, potentially introducing backdoored logic, breaking functionality, or corrupting the codebase before anyone notices the change wasn't reviewed.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.