CVE-2026-56838: PraisonAI: recipe run_stream skips dangerous-tool policy

HIGH

Published October 23, 2026

CISO Take

PraisonAI's streaming recipe path, recipe.run_stream(), skips the dangerous-tool policy check that recipe.run() enforces, so a recipe declaring execute_command runs even though allow_dangerous_tools is False. This is a local, user-interaction-required flaw (CVSS 7.8, CWE-78/693/863) that matters wherever teams load third-party or shared recipes, because a recipe that looks policy-compliant can still execute OS commands. Exploitation likelihood is unknown (no EPSS score), it is not in CISA KEV, and there is no public exploit or Nuclei template. Blast radius is limited today, with only 1 tracked downstream dependent, but the package has 187 other CVEs, which signals a weak security track record. Upgrade PraisonAI to 4.6.59 or later, and until then audit any code that calls run_stream() and treat untrusted recipes as untrusted code.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Moderate-to-high for organizations that use PraisonAI recipes from outside sources. The CVSS 7.8 rating reflects local attack vector, low complexity, no privileges and required user interaction, with high impact on confidentiality, integrity and availability. No EPSS data, KEV listing, public exploit or scanner template exists, so near-term mass exploitation is unlikely. The flaw is a policy-enforcement bypass: the safeguard exists but is skipped on one code path, so teams that rely on the default-deny control have a false sense of security. Exposure is highest where recipes are shared, downloaded from registries, or run by developers and CI jobs with access to credentials and API keys.

How does the attack unfold?

Initial Access

Attacker distributes a recipe that declares execute_command in TEMPLATE.yaml requires.tools and persuades a user to run it.

AML.T0010.005

Policy Bypass

The recipe is loaded via recipe.run_stream(), which skips _check_tool_policy() and ignores allow_dangerous_tools=False.

AML.T0053

Execution

The execution engine runs the dangerous execute_command tool and executes attacker-chosen OS commands.

AML.T0050

Impact

Attacker steals API keys, credentials and code from the host, or establishes persistent access.

AML.T0055

Initial Access

Attacker distributes a recipe that declares execute_command in TEMPLATE.yaml requires.tools and persuades a user to run it.

AML.T0010.005

Policy Bypass

The recipe is loaded via recipe.run_stream(), which skips _check_tool_policy() and ignores allow_dangerous_tools=False.

AML.T0053

Execution

The execution engine runs the dangerous execute_command tool and executes attacker-chosen OS commands.

AML.T0050

Impact

Attacker steals API keys, credentials and code from the host, or establishes persistent access.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVLocal

ACLow

PRNone

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade PraisonAI (pip) to 4.6.59 or later. 2) Until patched, avoid recipe.run_stream() for any recipe you did not author, or wrap calls with an explicit _check_tool_policy equivalent before execution. 3) Review recipe TEMPLATE.yaml files for dangerous tools such as execute_command and remove them where not needed. 4) Only load recipes from trusted, reviewed sources and pin them by hash or commit. 5) Run agents in sandboxed containers or low-privilege accounts with minimal credentials and restricted egress. 6) Detection: search code and logs for run_stream() usage, and monitor for unexpected child processes spawned by the PraisonAI Python process.

How is it classified?

Code ExecutionSupply ChainAuth BypassAgentFrameworkPluginAML.T0010.005- AI Agent Tool AML.T0011.002- Poisoned AI Agent Tool AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-56838?

Is CVE-2026-56838 actively exploited?

No confirmed active exploitation of CVE-2026-56838 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-56838?

1) Upgrade PraisonAI (pip) to 4.6.59 or later. 2) Until patched, avoid recipe.run_stream() for any recipe you did not author, or wrap calls with an explicit _check_tool_policy equivalent before execution. 3) Review recipe TEMPLATE.yaml files for dangerous tools such as execute_command and remove them where not needed. 4) Only load recipes from trusted, reviewed sources and pin them by hash or commit. 5) Run agents in sandboxed containers or low-privilege accounts with minimal credentials and restricted egress. 6) Detection: search code and logs for run_stream() usage, and monitor for unexpected child processes spawned by the PraisonAI Python process.

What systems are affected by CVE-2026-56838?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration, recipe/workflow execution, developer workstations and CI runners.

What is the CVSS score for CVE-2026-56838?

CVE-2026-56838 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.15%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestrationrecipe/workflow executiondeveloper workstations and CI runners

MITRE ATLAS Techniques

AML.T0010.005AI Agent Tool

AML.T0011.002Poisoned AI Agent Tool

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run() path enforces this with _check_tool_policy(). The streaming path, recipe.run_stream(), loads the same recipe, checks dependencies, and then calls _execute_recipe() without running the dangerous-tool policy check. As a result, a recipe that honestly declares execute_command in TEMPLATE.yaml requires.tools is denied by recipe.run(), but reaches the execution engine through recipe.run_stream() with allow_dangerous_tools=False. This issue has been patched in version 4.6.59.

Exploitation Scenario

An adversary publishes or shares a useful-looking PraisonAI recipe that declares execute_command in its TEMPLATE.yaml requires.tools. A developer or automation job loads the recipe through the streaming interface, run_stream(), for a live UI or progress output. Because the dangerous-tool policy check is skipped, the recipe's agent can invoke execute_command without the allow_dangerous_tools=True opt-in that recipe.run() would demand. The attacker's commands run on the host, harvesting environment variables, LLM API keys and cloud credentials, and may establish a reverse shell for further access.

Weaknesses (CWE)

CWE-693Protection Mechanism FailurePrimary CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Primary CWE-863Incorrect AuthorizationPrimary CWE-693Protection Mechanism Failure CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-863Incorrect Authorization

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.