CVE-2026-56834: PraisonAI: path traversal in artifact tools leaks files

HIGH

Published October 23, 2026

CISO Take

PraisonAI's Dynamic Context Discovery exposes artifact_head, artifact_tail, artifact_grep and artifact_chunk tools that read any caller-supplied path from the host filesystem, with no check that the path is a store-created artifact or sits under the artifact base directory. Anyone who can influence those tool arguments, including through prompt injection against an agent, can read .env files, cloud credentials, SSH keys and source code readable by the PraisonAI process. The CVSS is 7.5 (network, low complexity, no privileges, no user interaction, high confidentiality impact). No EPSS score is available, the CVE is not in CISA KEV and no public exploit or Nuclei template is known, but the exploit is trivial to build and the GitHub advisory is public. This package has 187 other CVEs and only 1 tracked downstream dependent, so the blast radius is mostly direct deployments. Upgrade to PraisonAI 4.6.59 or later, and rotate any credentials on hosts running 3.8.1 through 4.6.58 that exposed agents to untrusted input.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High. Exploitation is low complexity and needs no authentication or user interaction when an agent is reachable over the network or accepts untrusted prompts. Impact is limited to confidentiality (arbitrary file read), but the files exposed are typically high-value secrets such as API keys, cloud credentials and SSH keys, which enable follow-on compromise. Likelihood is moderate: there is no known active exploitation, no KEV listing and no public exploit, but the repeated vulnerability history of this package (187 other CVEs) suggests researchers and attackers are paying attention. Exposure depends on whether the Dynamic Context Discovery feature is enabled and whether untrusted users or content can steer agent tool calls.

How does the attack unfold?

Initial Access

The attacker reaches a PraisonAI agent through its exposed interface or plants instructions in content the agent ingests.

AML.T0093

Tool Invocation

The attacker steers the agent to call an artifact_* tool with an arbitrary path such as a .env file or ~/.ssh/id_rsa.

AML.T0053

Collection

The tool reads the file from the host filesystem without path validation and returns its contents.

AML.T0037

Impact

Stolen API keys, cloud credentials and SSH keys enable account takeover, data access and lateral movement.

AML.T0098

Initial Access

The attacker reaches a PraisonAI agent through its exposed interface or plants instructions in content the agent ingests.

AML.T0093

Tool Invocation

The attacker steers the agent to call an artifact_* tool with an arbitrary path such as a .env file or ~/.ssh/id_rsa.

AML.T0053

Collection

The tool reads the file from the host filesystem without path validation and returns its contents.

AML.T0037

Impact

Stolen API keys, cloud credentials and SSH keys enable account takeover, data access and lateral movement.

AML.T0098

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade PraisonAI to 4.6.59 or later. 2) If patching is not immediate, disable Dynamic Context Discovery or do not expose the artifact_* tools to agents. 3) Run agents as an unprivileged user in a container or sandbox with a read-only, minimal filesystem that holds no credentials, and use short-lived scoped credentials instead of long-lived .env secrets. 4) Restrict network exposure of agent endpoints and require authentication. 5) Rotate API keys, cloud credentials and SSH keys on any host that ran an affected version with untrusted input. 6) Detect: review agent and tool-call logs for artifact_head, artifact_tail, artifact_grep or artifact_chunk calls with paths outside the artifact base directory (for example /etc, ~/.ssh, ~/.aws, .env, ../ sequences), and alert on unexpected reads of credential files by the agent process.

How is it classified?

Data ExtractionData LeakagePrompt InjectionAgentFrameworkPluginAML.T0037- Data from Local System AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0055- Unsecured Credentials AML.T0085.001- AI Agent Tools AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to Unknown Risks and Residual Risks

OWASP LLM Top 10

LLM01-Prompt InjectionLLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-56834?

Is CVE-2026-56834 actively exploited?

No confirmed active exploitation of CVE-2026-56834 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56834?

1) Upgrade PraisonAI to 4.6.59 or later. 2) If patching is not immediate, disable Dynamic Context Discovery or do not expose the artifact_* tools to agents. 3) Run agents as an unprivileged user in a container or sandbox with a read-only, minimal filesystem that holds no credentials, and use short-lived scoped credentials instead of long-lived .env secrets. 4) Restrict network exposure of agent endpoints and require authentication. 5) Rotate API keys, cloud credentials and SSH keys on any host that ran an affected version with untrusted input. 6) Detect: review agent and tool-call logs for artifact_head, artifact_tail, artifact_grep or artifact_chunk calls with paths outside the artifact base directory (for example /etc, ~/.ssh, ~/.aws, .env, ../ sequences), and alert on unexpected reads of credential files by the agent process.

What systems are affected by CVE-2026-56834?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, tool-calling agents, agentic workflows with context discovery.

What is the CVSS score for CVE-2026-56834?

CVE-2026-56834 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemstool-calling agentsagentic workflows with context discovery

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0055Unsecured Credentials

AML.T0085.001AI Agent Tools

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM01, LLM02, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_path is an artifact created by the configured store or that it lives under the configured artifact base directory. Instead, artifact_head, artifact_tail, artifact_grep, and artifact_chunk wrap the caller-supplied path directly into an ArtifactRef and then read it from the host filesystem. As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data. This issue has been patched in version 4.6.59.

Exploitation Scenario

An attacker finds a PraisonAI-based support agent that uses Dynamic Context Discovery and accepts user input or reads external content. They send a prompt, or plant instructions in a document the agent ingests, telling it to call artifact_grep or artifact_head on /app/.env or ~/.aws/credentials. The tool wraps the supplied path into an ArtifactRef and reads it from the host filesystem, then returns the contents to the attacker through the agent's response. The attacker uses the stolen LLM provider and cloud keys to run up costs, access data stores or move laterally into the organization's cloud environment.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-200Exposure of Sensitive Information to an Unauthorized Actor CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.