AI Threat AlertCVE-2026-57144: PraisonAI: sandbox fails open, bypassing FS/network limits
HIGHPraisonAI's SandlockSandbox, documented as the kernel-enforced sandbox for untrusted agent code, silently falls back to an unenforced subprocess when Landlock is unavailable. The code then runs with no filesystem or network restrictions even though the configuration says network=False. This is a fail-open design flaw rated CVSS 8.8 (High) that affects versions 4.5.110 up to 4.6.61. It matters because teams rely on this sandbox to run LLM-generated or third-party code, so any payload can read files outside the allowed path and open outbound connections, which allows credential theft and data exfiltration. No EPSS score, public exploit, Nuclei template or CISA KEV listing exists at publication, so there is no sign of active exploitation yet, but exploitation is trivial for anyone who can submit code to the agent. Upgrade to 4.6.61 or later, and until then treat any host where Landlock is unavailable as having no sandbox.
What is the risk?
High. The attack is local with low complexity, low privileges and no user interaction, and the scope is changed because the security boundary is crossed. Confidentiality, integrity and availability impact are all rated high. Exposure depends on deployments that run untrusted or LLM-generated code through SandlockSandbox on kernels or containers where Landlock is unavailable (older kernels, restricted container runtimes, some CI and cloud images). No known exploitation, public PoC or KEV listing as of publication, and exploitation would be trivial for anyone able to submit code to an agent. The silent fallback means operators get no warning that the protection is missing.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | — | No patch |
Do you use PraisonAI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade praisonai to 4.6.61 or later. 2) Until patched, check whether Landlock is actually available on each host (kernel 5.13 or later with Landlock enabled), and do not rely on SandlockSandbox where it is not. 3) Run agent code in a hardened container or VM with an enforced network policy (egress deny by default), a read-only root filesystem and only the required mounts. 4) Remove secrets and credentials from the environment and filesystem visible to agent execution contexts. 5) Detect abuse by monitoring for outbound connections from sandbox worker processes, file reads outside the configured allowed paths, and log lines showing a fallback to SubprocessSandbox. 6) Inventory every use of SandboxConfig.native() and review the code paths that execute untrusted code.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-57144?
PraisonAI's SandlockSandbox, documented as the kernel-enforced sandbox for untrusted agent code, silently falls back to an unenforced subprocess when Landlock is unavailable. The code then runs with no filesystem or network restrictions even though the configuration says network=False. This is a fail-open design flaw rated CVSS 8.8 (High) that affects versions 4.5.110 up to 4.6.61. It matters because teams rely on this sandbox to run LLM-generated or third-party code, so any payload can read files outside the allowed path and open outbound connections, which allows credential theft and data exfiltration. No EPSS score, public exploit, Nuclei template or CISA KEV listing exists at publication, so there is no sign of active exploitation yet, but exploitation is trivial for anyone who can submit code to the agent. Upgrade to 4.6.61 or later, and until then treat any host where Landlock is unavailable as having no sandbox.
Is CVE-2026-57144 actively exploited?
No confirmed active exploitation of CVE-2026-57144 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-57144?
1) Upgrade praisonai to 4.6.61 or later. 2) Until patched, check whether Landlock is actually available on each host (kernel 5.13 or later with Landlock enabled), and do not rely on SandlockSandbox where it is not. 3) Run agent code in a hardened container or VM with an enforced network policy (egress deny by default), a read-only root filesystem and only the required mounts. 4) Remove secrets and credentials from the environment and filesystem visible to agent execution contexts. 5) Detect abuse by monitoring for outbound connections from sandbox worker processes, file reads outside the configured allowed paths, and log lines showing a fallback to SubprocessSandbox. 6) Inventory every use of SandboxConfig.native() and review the code paths that execute untrusted code.
What systems are affected by CVE-2026-57144?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent systems, code execution sandboxes, agent tool execution pipelines.
What is the CVSS score for CVE-2026-57144?
CVE-2026-57144 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.21%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0025Exfiltration via Cyber MeansAML.T0037Data from Local SystemAML.T0053AI Agent Tool InvocationAML.T0107Exploitation for Defense EvasionCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native() path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports that Landlock is unavailable, SandlockSandbox.execute() and run_command() do not fail closed. They silently fall back to SubprocessSandbox(self.config). That fallback keeps the same high-level native policy object but does not enforce the native filesystem or network boundary during code execution. A sandboxed payload can read files outside the configured allowed path and open network connections despite network=False. This issue has been patched in version 4.6.61.
Exploitation Scenario
An attacker gets an agent to run code, either as a legitimate low-privileged user of a shared PraisonAI service or through a prompt injection that makes the agent generate and execute a script. The host kernel lacks Landlock, so the sandbox silently falls back to a plain subprocess. The payload reads credentials such as ~/.ssh keys, .env files and cloud tokens from outside the allowed directory and sends them to an attacker-controlled server, even though network=False was configured. The attacker then uses the stolen credentials to reach other systems.
Weaknesses (CWE)
CWE-266Incorrect Privilege AssignmentPrimaryCWE-668Exposure of Resource to Wrong SpherePrimaryCWE-693Protection Mechanism FailurePrimaryCWE-266Incorrect Privilege AssignmentCWE-668Exposure of Resource to Wrong SphereCWE-693Protection Mechanism FailureCWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- [Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- [Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HTimeline
Related Vulnerabilities
CVE-2026-4816810.0PraisonAI: shell injection in Claude Action enables RCE
Same package: praisonaiCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiCVE-2026-614459.9PraisonAI: AICoder root RCE via unsanitized tool calls
Same package: praisonaiGHSA-vmmj-pfw7-fjwp9.9praisonai: sandbox escape gives RCE via codeMode tool
Same package: praisonaiCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonai