AI Threat AlertCVE-2026-57137: PraisonAI: approval bypass runs rejected agent tools
HIGHPoC AVAILABLECISA: ATTENDPraisonAI's TypeScript agent loop (versions 1.4.0 to before 1.7.2) hands executable tools to the AI SDK before the onToolCall approval callback runs. A tool that a human or policy rejects has therefore already executed, and the denial is only logged afterward as tool_rejected. Any team that uses onToolCall as its human-in-the-loop or policy gate for file, command, API or data-modifying actions has no real control, and the audit log will wrongly show those actions as blocked. Exploitation likelihood is moderate (EPSS 0.5%, 59th percentile), and the CVE is not in CISA KEV, with no public exploit or Nuclei template. CISA SSVC rates it ATTEND, and the CVSS 8.8 reflects network reach, low complexity and high impact. Upgrade to 1.7.2 or later, and until then treat approval callbacks as non-functional and remove high-risk tools from affected agents.
What is the risk?
High. The flaw is a logic error in an authorization control, so no special skill is needed beyond being able to get the agent to call a tool. The attacker needs low privileges (an account or access to the agent's input channel) and no user interaction. Impact is high across confidentiality, integrity and availability because the bypassed tools can include shell, file and API actions. Exploitation signals are modest: no KEV listing, no public exploit and a low EPSS. Exposure is limited to deployments that use the TypeScript package with onToolCall as a security boundary. Dependents are unknown, so the blast radius cannot be quantified.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | — | No patch |
Do you use PraisonAI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
6 stepsUpgrade PraisonAI to 1.7.2 or later (see GHSA-h2w2-v7j6-xqm4 and the linked fix commit).
Until patched, do not rely on onToolCall for security. Remove or disable destructive tools (shell, file write, delete, payment or admin APIs) for agents on affected versions.
Run agents with least-privilege credentials, in sandboxed or containerized environments with restricted filesystem and network egress.
Move enforcement into the tool handler itself (check authorization inside each tool before it acts).
Detection: review logs for tool_rejected events and correlate them with actual side effects, such as file changes, process execution or API calls at the same time. Any match is evidence of the bypass being hit.
Inventory repositories and lockfiles for praisonai or praisonaiagents in the affected range.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-57137?
PraisonAI's TypeScript agent loop (versions 1.4.0 to before 1.7.2) hands executable tools to the AI SDK before the onToolCall approval callback runs. A tool that a human or policy rejects has therefore already executed, and the denial is only logged afterward as tool_rejected. Any team that uses onToolCall as its human-in-the-loop or policy gate for file, command, API or data-modifying actions has no real control, and the audit log will wrongly show those actions as blocked. Exploitation likelihood is moderate (EPSS 0.5%, 59th percentile), and the CVE is not in CISA KEV, with no public exploit or Nuclei template. CISA SSVC rates it ATTEND, and the CVSS 8.8 reflects network reach, low complexity and high impact. Upgrade to 1.7.2 or later, and until then treat approval callbacks as non-functional and remove high-risk tools from affected agents.
Is CVE-2026-57137 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2026-57137, increasing the risk of exploitation.
How to fix CVE-2026-57137?
1. Upgrade PraisonAI to 1.7.2 or later (see GHSA-h2w2-v7j6-xqm4 and the linked fix commit). 2. Until patched, do not rely on onToolCall for security. Remove or disable destructive tools (shell, file write, delete, payment or admin APIs) for agents on affected versions. 3. Run agents with least-privilege credentials, in sandboxed or containerized environments with restricted filesystem and network egress. 4. Move enforcement into the tool handler itself (check authorization inside each tool before it acts). 5. Detection: review logs for tool_rejected events and correlate them with actual side effects, such as file changes, process execution or API calls at the same time. Any match is evidence of the bypass being hit. 6. Inventory repositories and lockfiles for praisonai or praisonaiagents in the affected range.
What systems are affected by CVE-2026-57137?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, human-in-the-loop approval workflows, tool-calling pipelines.
What is the CVSS score for CVE-2026-57137?
CVE-2026-57137 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.51%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0053AI Agent Tool InvocationAML.T0086Exfiltration via AI Agent Tool InvocationAML.T0101Data Destruction via AI Agent Tool InvocationCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI SDK executes tool handlers during generation, a callback that returns false records tool_rejected only after the denied tool has already produced side effects and populated toolResults. Applications using onToolCall as a human or policy approval boundary can therefore execute rejected file, command, API, or data-modifying operations. This issue is fixed in version 1.7.2.
Exploitation Scenario
An organization deploys a PraisonAI TypeScript agent with a shell tool and file tools, and requires human approval through onToolCall for any destructive action. A low-privileged user, or an attacker using prompt injection through a document or web page the agent reads, steers the agent to call the shell tool with a command that exfiltrates credentials or deletes data. The approval callback prompts a reviewer, who rejects it. Because the AI SDK already executed the tool during generation, the command has run, and the log shows only tool_rejected. The team believes the control worked.
Weaknesses (CWE)
CWE-693Protection Mechanism FailurePrimaryCWE-862Missing AuthorizationPrimaryCWE-863Incorrect AuthorizationPrimaryCWE-693Protection Mechanism FailureCWE-862Missing AuthorizationCWE-863Incorrect AuthorizationCWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-4816810.0PraisonAI: shell injection in Claude Action enables RCE
Same package: praisonaiCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiCVE-2026-614459.9PraisonAI: AICoder root RCE via unsanitized tool calls
Same package: praisonaiGHSA-vmmj-pfw7-fjwp9.9praisonai: sandbox escape gives RCE via codeMode tool
Same package: praisonaiCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonai