AI Threat AlertCVE-2026-56832: PraisonAI: Discord approval bypass allows tool call hijack
HIGHPraisonAI's Discord approval backend (versions 4.5.2 to before 4.6.59) approves a pending dangerous tool call when any later non-bot message in the approval channel reads as "yes", so any user who can post there can authorize high-risk agent actions without being the intended approver. This defeats the human-in-the-loop control organizations rely on to contain agent autonomy, and the CVSS 8.8 score reflects the potential for full confidentiality, integrity and availability impact through whatever tools the agent holds. Exploitation is trivial (a single chat message), but there is no KEV listing, no public exploit, no Nuclei template and no EPSS data, and only 1 downstream dependent is tracked, so broad exposure looks limited. The package has 187 other CVEs, which signals weak security hygiene, so treat it as a risk-accepting dependency. Upgrade to 4.6.59 or later, restrict the approval channel to named approvers, and audit past approvals in Discord logs.
What is the risk?
High severity, but the real-world risk depends on deployment. Exploitation needs low privileges (membership of the approval channel) and no user interaction, with low complexity. No known active exploitation (not in CISA KEV), no public exploit and no scanner template, and EPSS is unavailable. The risk is highest where agents hold powerful tools (shell, file system, cloud credentials, payments) and the approval channel is a shared or public Discord server. Slack and Telegram backends also lack an explicit approver allowlist, which widens the exposure for those integrations.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | — | No patch |
Do you use PraisonAI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade PraisonAI to 4.6.59 or later. 2) Until patched, disable the Discord, Slack and Telegram approval backends for high-risk tools, or switch to an approval mechanism that binds to a specific authenticated approver. 3) Restrict approval channels to a minimal, trusted set of members and remove bots or users who do not need posting rights. 4) Enforce least privilege on agent tools and run agents in sandboxed environments with scoped credentials. 5) Detection: review Discord, Slack and Telegram channel logs for approval messages from unexpected users, correlate approvals with executed tool calls, and alert on dangerous tool executions that follow approval messages from non-designated approvers. 6) Add an approver allowlist wherever the backend supports one, and require request-bound (threaded or reply-based) approvals.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-56832?
PraisonAI's Discord approval backend (versions 4.5.2 to before 4.6.59) approves a pending dangerous tool call when any later non-bot message in the approval channel reads as "yes", so any user who can post there can authorize high-risk agent actions without being the intended approver. This defeats the human-in-the-loop control organizations rely on to contain agent autonomy, and the CVSS 8.8 score reflects the potential for full confidentiality, integrity and availability impact through whatever tools the agent holds. Exploitation is trivial (a single chat message), but there is no KEV listing, no public exploit, no Nuclei template and no EPSS data, and only 1 downstream dependent is tracked, so broad exposure looks limited. The package has 187 other CVEs, which signals weak security hygiene, so treat it as a risk-accepting dependency. Upgrade to 4.6.59 or later, restrict the approval channel to named approvers, and audit past approvals in Discord logs.
Is CVE-2026-56832 actively exploited?
No confirmed active exploitation of CVE-2026-56832 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-56832?
1) Upgrade PraisonAI to 4.6.59 or later. 2) Until patched, disable the Discord, Slack and Telegram approval backends for high-risk tools, or switch to an approval mechanism that binds to a specific authenticated approver. 3) Restrict approval channels to a minimal, trusted set of members and remove bots or users who do not need posting rights. 4) Enforce least privilege on agent tools and run agents in sandboxed environments with scoped credentials. 5) Detection: review Discord, Slack and Telegram channel logs for approval messages from unexpected users, correlate approvals with executed tool calls, and alert on dangerous tool executions that follow approval messages from non-designated approvers. 6) Add an approver allowlist wherever the backend supports one, and require request-bound (threaded or reply-based) approvals.
What systems are affected by CVE-2026-56832?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, human-in-the-loop approval workflows, chatops-integrated AI agents.
What is the CVSS score for CVE-2026-56832?
CVE-2026-56832 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.15%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.
Exploitation Scenario
An organization runs a PraisonAI agent with shell and cloud API tools, and uses a shared Discord channel for approvals of dangerous actions. An attacker with low-privilege access to that channel (a contractor, a compromised account or a community member) waits until the agent posts an approval request. The attacker immediately posts "yes", which the backend classifies as approval, so the agent runs the pending high-risk tool call, such as executing a command or exfiltrating data. Alternatively, the attacker can induce the agent to request a risky action through prompt manipulation and then self-approve it.
Weaknesses (CWE)
CWE-345Insufficient Verification of Data AuthenticityPrimaryCWE-863Incorrect AuthorizationPrimaryCWE-345Insufficient Verification of Data AuthenticityCWE-863Incorrect AuthorizationCWE-345 — Insufficient Verification of Data Authenticity: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2mx_refsource_CONFIRM
Timeline
Related Vulnerabilities
CVE-2026-4816810.0PraisonAI: shell injection in Claude Action enables RCE
Same package: praisonaiCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiCVE-2026-614459.9PraisonAI: AICoder root RCE via unsanitized tool calls
Same package: praisonaiGHSA-vmmj-pfw7-fjwp9.9praisonai: sandbox escape gives RCE via codeMode tool
Same package: praisonaiCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonai