CVE-2026-56835High· 8.3▾ MidnightPoC availablePraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handle…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 45.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Last analysed / modified upstream
Exploit / PoC code exists
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.
PraisonAI >= 3.11.0, < 4.6.59Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
praisonai >= 3.11.0, < 4.6.59Patched in:
praisonai 4.6.59Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57112High· 8.3PraisonAI is a multi-agent teams system
CVE-2026-56839High· 7.3PraisonAI is a multi-agent teams system
CVE-2026-57131Critical· 9.8PraisonAI is a multi-agent teams system
CVE-2026-57116Critical· 9.8PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
CVE-2026-57125Critical· 9.8PraisonAI is a multi-agent teams system
CVE-2026-56074Medium· 5.5PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command calls to bypass approval prompts