CVE-2026-60087: PraisonAI approval caching flaw

CISO Take

PraisonAI caches a user's approval of an agent tool call by tool name only, not by the arguments passed to it, so once a user approves one benign invocation of a tool in a session, the cached approval is silently reused for later calls to the same tool with completely different, unreviewed parameters. This matters because tool-approval prompts are the primary human-in-the-loop control that stands between an autonomous AI agent's decisions and real filesystem actions, and this bug quietly defeats that control after a single approval. There is no confidentiality impact per the CVSS vector, but integrity is rated High and availability Low, reflecting the ability to trigger arbitrary file writes once inside an approved session. No public exploit, CISA KEV listing, or EPSS score exists yet and the attack vector is local with required user interaction, so this is not an active-exploitation emergency, but it directly undermines the approval workflow that PraisonAI deployments rely on for safe tool use. Upgrade to PraisonAI 1.6.78 or later, and until patched, treat every agent tool call as requiring fresh, argument-level review rather than trusting a single per-session approval, especially for file-write-capable tools.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity (CVSS 6.1) reflecting a locally-exploitable, low-complexity, no-privilege-required broken-authorization flaw with high integrity impact and low availability impact, and no confidentiality impact. Exploitability is gated by one instance of required user interaction (the initial benign approval) rather than by any technical barrier, meaning the practical bar to exploitation is low once an attacker can influence what the agent proposes to do (e.g., via a malicious tool description, injected content, or a compromised upstream integration). No EPSS score, no CISA KEV listing, and no public exploit or Nuclei template exist, so there is no evidence of active or scripted exploitation in the wild today. The package has 138 other tracked CVEs and only 1 known downstream dependent recorded, keeping the current measured blast radius narrow, though PraisonAI's real-world adoption as an agent framework is broader than the dependent count suggests.

How does the attack unfold?

Initial approval

The AI agent proposes a benign tool call (e.g., a routine file write) which the user reviews and approves once in the session.

AML.T0053

Cache bypass trigger

Untrusted content processed later in the session (or a direct follow-up) causes the agent to invoke the same tool again, this time with attacker-chosen, dangerous arguments.

AML.T0051

Unreviewed execution

Because PraisonAI's approval cache keys on tool name only, the new call executes without re-prompting the user, bypassing the intended per-call review.

AML.T0053

Impact

The tool performs an arbitrary file write outside the originally approved scope, potentially overwriting configuration, credentials, or other sensitive files and enabling further compromise.

AML.T0101

Initial approval

The AI agent proposes a benign tool call (e.g., a routine file write) which the user reviews and approves once in the session.

AML.T0053

Cache bypass trigger

Untrusted content processed later in the session (or a direct follow-up) causes the agent to invoke the same tool again, this time with attacker-chosen, dangerous arguments.

AML.T0051

Unreviewed execution

Because PraisonAI's approval cache keys on tool name only, the new call executes without re-prompting the user, bypassing the intended per-call review.

AML.T0053

Impact

The tool performs an arbitrary file write outside the originally approved scope, potentially overwriting configuration, credentials, or other sensitive files and enabling further compromise.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C None

I High

A Low

What should I do?

1 step

Upgrade to PraisonAI 1.6.78 or later, where tool approval should be scoped per invocation/arguments rather than cached by tool name alone. Until upgraded, avoid granting session-long trust to file-write-capable tools; where possible, disable or tightly scope any tool with filesystem write access, and run agent sessions with least-privilege OS-level file permissions so a rogue write cannot reach sensitive paths. Review any custom tool-approval UX built on PraisonAI to confirm it is not relying on the vulnerable caching behavior. For detection, monitor file-write tool invocations within a session for argument values (paths, filenames) that diverge significantly from what was originally approved, and audit logs for repeated same-tool-name calls with materially different parameters in a single session.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0051 - LLM Prompt Injection AML.T0053 - AI Agent Tool Invocation AML.T0101 - Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 14 - Human Oversight

ISO 42001

A.9.3 - AI system operation and monitoring

NIST AI RMF

MANAGE-1.3 - Mechanisms to supersede or disengage AI system actions

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-60087?

PraisonAI caches a user's approval of an agent tool call by tool name only, not by the arguments passed to it, so once a user approves one benign invocation of a tool in a session, the cached approval is silently reused for later calls to the same tool with completely different, unreviewed parameters. This matters because tool-approval prompts are the primary human-in-the-loop control that stands between an autonomous AI agent's decisions and real filesystem actions, and this bug quietly defeats that control after a single approval. There is no confidentiality impact per the CVSS vector, but integrity is rated High and availability Low, reflecting the ability to trigger arbitrary file writes once inside an approved session. No public exploit, CISA KEV listing, or EPSS score exists yet and the attack vector is local with required user interaction, so this is not an active-exploitation emergency, but it directly undermines the approval workflow that PraisonAI deployments rely on for safe tool use. Upgrade to PraisonAI 1.6.78 or later, and until patched, treat every agent tool call as requiring fresh, argument-level review rather than trusting a single per-session approval, especially for file-write-capable tools.

Is CVE-2026-60087 actively exploited?

No confirmed active exploitation of CVE-2026-60087 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-60087?

Upgrade to PraisonAI 1.6.78 or later, where tool approval should be scoped per invocation/arguments rather than cached by tool name alone. Until upgraded, avoid granting session-long trust to file-write-capable tools; where possible, disable or tightly scope any tool with filesystem write access, and run agent sessions with least-privilege OS-level file permissions so a rogue write cannot reach sensitive paths. Review any custom tool-approval UX built on PraisonAI to confirm it is not relying on the vulnerable caching behavior. For detection, monitor file-write tool invocations within a session for argument values (paths, filenames) that diverge significantly from what was originally approved, and audit logs for repeated same-tool-name calls with materially different parameters in a single session.

What systems are affected by CVE-2026-60087?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agentic tool-use workflows.

What is the CVSS score for CVE-2026-60087?

CVE-2026-60087 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.15%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagentic tool-use workflows

MITRE ATLAS Techniques

AML.T0051 LLM Prompt Injection

AML.T0053 AI Agent Tool Invocation

AML.T0101 Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 14

ISO 42001: A.9.3

NIST AI RMF: MANAGE-1.3

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in the same session.

Exploitation Scenario

A developer uses a PraisonAI agent wired to a file-write tool for a legitimate task, such as saving a generated report to a specified output directory, and approves that single tool call when prompted. Later in the same session, the agent processes untrusted content — for example a document it was asked to summarize, or output from another tool — that contains an injected instruction directing the agent to invoke the same file-write tool again, this time with a path traversal payload targeting a configuration file, SSH key, or startup script instead of the original report location. Because PraisonAI's approval cache only checks that the tool name ('write_file') was previously approved, it does not re-prompt the user for these new, dangerous arguments, and the write proceeds silently, giving the attacker persistence or a foothold for further compromise on the host.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.