CVE-2026-56835: PraisonAI: Slack app_mention bypasses access policy

HIGH

Published October 23, 2026

CISO Take

PraisonAI versions 3.11.0 through 4.6.58 enforce the Slack bot's allowed_users, allowed_channels and unknown_user_policy only on the normal message handler, not on the app_mention handler. Any workspace member who can @mention the bot in a channel where the app is installed can therefore trigger the configured agent, even if the same message would be dropped by the access policy. The CVSS score is 8.3 (high) because the agent may hold tools, credentials and data that the allowlist was meant to protect. Exploitation needs only a low-privileged Slack account and no special skill. Mitigating factors: this is not in CISA KEV, no public exploit or Nuclei template exists, EPSS is not yet available, and the tracked downstream footprint is small (1 dependent). Upgrade to 4.6.59 or later, and until then restrict the Slack app's channel membership and the tools or credentials available to the agent.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High. The flaw is a missing authorization check (CWE-862/CWE-863) reachable over the network with low privileges and no user interaction. The impact depends on what the agent can do: with tool access, file access or connected credentials, a bypass can lead to confidentiality and integrity loss (C:H/I:H). Exposure is limited to organizations that run the PraisonAI Slack bot and rely on allowed_users, allowed_channels or unknown_user_policy=deny as their access boundary. There is no known active exploitation, no public PoC and no KEV listing, and EPSS data is not available. Likelihood is therefore moderate despite the trivial exploit mechanics. The package has had 187 other CVEs, which signals a heavy ongoing vulnerability load.

How does the attack unfold?

Initial Access

An unauthorized but legitimate Slack workspace user finds a channel where the PraisonAI app is present.

AML.T0012

Policy Bypass

The user @mentions the bot, and the app_mention handler skips the allowed_users, allowed_channels and unknown_user_policy checks.

AML.T0049

Agent Invocation

The configured PraisonAI agent runs on the attacker's prompt and invokes its tools with its own privileges.

AML.T0053

Impact

Sensitive data is returned in the channel or unauthorized actions are performed on connected systems.

AML.T0085.001

Initial Access

An unauthorized but legitimate Slack workspace user finds a channel where the PraisonAI app is present.

AML.T0012

Policy Bypass

The user @mentions the bot, and the app_mention handler skips the allowed_users, allowed_channels and unknown_user_policy checks.

AML.T0049

Agent Invocation

The configured PraisonAI agent runs on the attacker's prompt and invokes its tools with its own privileges.

AML.T0053

Impact

Sensitive data is returned in the channel or unauthorized actions are performed on connected systems.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

ALow

What should I do?

6 steps

Upgrade PraisonAI to 4.6.59 or later (pip install -U praisonai).
Until patched, remove the Slack app from channels where untrusted users are present, or disable the app_mention event subscription in the Slack app configuration.
Apply least privilege to the agent: remove high-risk tools, scope credentials and tokens, and require human approval for destructive or sensitive actions.
Review Slack and PraisonAI logs for app_mention events from users or channels not in allowed_users or allowed_channels, since the vulnerable version 3.11.0 or later was deployed.
Add a regression test or monitoring that confirms denied users receive no agent response through any event type.
Rotate secrets the agent could access if unauthorized invocations are found. Reference: GHSA-qvpf-j64c-jmhr.

How is it classified?

Auth BypassData LeakageAgentFrameworkPluginAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.9.2-Processes for responsible use of AI systems

NIST AI RMF

MANAGE 2.3-Mechanisms to respond to and recover from unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-56835?

Is CVE-2026-56835 actively exploited?

No confirmed active exploitation of CVE-2026-56835 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56835?

1. Upgrade PraisonAI to 4.6.59 or later (pip install -U praisonai). 2. Until patched, remove the Slack app from channels where untrusted users are present, or disable the app_mention event subscription in the Slack app configuration. 3. Apply least privilege to the agent: remove high-risk tools, scope credentials and tokens, and require human approval for destructive or sensitive actions. 4. Review Slack and PraisonAI logs for app_mention events from users or channels not in allowed_users or allowed_channels, since the vulnerable version 3.11.0 or later was deployed. 5. Add a regression test or monitoring that confirms denied users receive no agent response through any event type. 6. Rotate secrets the agent could access if unauthorized invocations are found. Reference: GHSA-qvpf-j64c-jmhr.

What systems are affected by CVE-2026-56835?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, chatbot integrations, tool-calling agents.

What is the CVSS score for CVE-2026-56835?

CVE-2026-56835 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent systemschatbot integrationstool-calling agents

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.

Exploitation Scenario

An organization runs a PraisonAI agent in Slack with allowed_users set to the security team and unknown_user_policy=deny, and the agent has tools for ticketing, internal document search and cloud queries. A contractor with a regular Slack account, not on the allowlist, finds the bot in a shared channel. Plain messages are silently dropped, but when the contractor @mentions the bot, the app_mention handler skips the policy checks and runs the agent. The contractor asks it to search internal documents and summarize credentials or incident data, or to run a ticketing or cloud action. The agent executes with its own privileges and returns the results in the channel.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-863Incorrect AuthorizationPrimary CWE-862Missing Authorization CWE-863Incorrect Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.