CVE-2026-34934: PraisonAI SQL Injection Vulnerability

CVE-2026-34934 Overview

CVE-2026-34934 is a critical SQL Injection vulnerability affecting PraisonAI, a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker can store a malicious thread ID via the update_thread function, and when the application loads the thread list, the injected payload executes, granting full database access.

Critical Impact

This SQL Injection vulnerability allows unauthenticated remote attackers to gain complete database access through stored malicious thread IDs, potentially compromising all data stored within the PraisonAI system.

Affected Products

• PraisonAI versions prior to 4.5.90

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-34934 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-34934

Vulnerability Analysis

This vulnerability stems from improper input validation and unsafe SQL query construction within PraisonAI's thread management functionality. The get_all_user_threads function retrieves thread IDs from the database and incorporates them directly into SQL queries using Python f-strings without proper sanitization or parameterization. This creates a second-order SQL injection attack vector where malicious data stored in one operation (via update_thread) is later executed as part of a SQL query in another operation.

The attack flow involves two stages: first, an attacker uses the update_thread function to store a crafted SQL injection payload as a thread ID. Second, when the application subsequently calls get_all_user_threads to retrieve the thread list, the stored malicious thread ID is interpolated directly into a SQL query string, causing the injected SQL code to execute with the database privileges of the application.

Root Cause

The root cause is the use of Python f-strings for SQL query construction instead of parameterized queries or prepared statements. The vulnerable code path trusts data retrieved from the database without recognizing that this data may have been manipulated by an attacker. This represents a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) vulnerability pattern, specifically manifesting as a stored or second-order SQL injection.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can remotely exploit this vulnerability by:

1. Calling the update_thread function with a malicious thread ID containing SQL injection payload
2. Waiting for or triggering a call to get_all_user_threads
3. The stored payload executes within the database context, allowing the attacker to read, modify, or delete data, potentially escalate privileges, or execute administrative database operations

The vulnerability mechanism involves unsafe string interpolation where user-controlled data is embedded directly into SQL queries. When the get_all_user_threads function builds its query using f-strings, any SQL metacharacters in the stored thread ID are interpreted as SQL syntax rather than data. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-34934

Indicators of Compromise

• Unusual or malformed thread IDs in the database containing SQL syntax characters such as single quotes, semicolons, or SQL keywords
• Database error logs showing SQL syntax errors related to thread queries
• Unexpected database queries or data modifications not initiated by legitimate application operations
• Anomalous database access patterns or privilege escalation attempts

Detection Strategies

• Monitor application logs for SQL-related exceptions or errors in thread management functions
• Implement database activity monitoring to detect unusual query patterns or unauthorized data access
• Deploy web application firewall (WAF) rules to identify SQL injection patterns in API requests to thread-related endpoints
• Conduct periodic database audits to identify suspicious thread IDs containing potential SQL injection payloads

Monitoring Recommendations

• Enable detailed logging for all database operations related to thread management
• Configure alerts for SQL syntax errors or failed query executions in the PraisonAI application
• Monitor for unauthorized database schema changes or bulk data exfiltration attempts
• Implement real-time monitoring of database connection activity for anomalous behavior

How to Mitigate CVE-2026-34934

Immediate Actions Required

• Upgrade PraisonAI to version 4.5.90 or later immediately
• Audit the database for existing malicious thread IDs containing SQL injection payloads
• Review application logs for evidence of prior exploitation attempts
• Restrict network access to the PraisonAI instance until patching is complete

Patch Information

The vulnerability has been patched in PraisonAI version 4.5.90. Organizations should upgrade to this version or later to remediate the SQL injection vulnerability. The patch implements proper input sanitization and parameterized queries for the get_all_user_threads function. For complete patch details, refer to the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, restrict access to the PraisonAI application to trusted networks only
• Implement database-level input validation to reject thread IDs containing SQL metacharacters
• Deploy a web application firewall with SQL injection detection rules in front of the PraisonAI application
• Consider disabling or restricting access to thread management functionality until the patch can be applied

# Example: Upgrade PraisonAI to patched version
pip install --upgrade praisonai>=4.5.90