CVE-2026-40159: PraisonAI Information Disclosure Flaw

CVE-2026-40159 Overview

CVE-2026-40159 is a sensitive data exposure vulnerability in PraisonAI, a multi-agent teams system. The vulnerability exists in PraisonAI's MCP (Model Context Protocol) integration, which allows spawning background servers via stdio using user-supplied command strings. When MCP commands are executed through Python's subprocess module, the implementation forwards the entire parent process environment to the spawned subprocess by default. This behavior exposes sensitive data such as API keys, authentication tokens, and database credentials to potentially untrusted or third-party commands.

Critical Impact
Untrusted MCP commands can inherit and access all environment variables from the host process, enabling credential theft and supply chain attacks through silent exfiltration of secrets.

Affected Products

PraisonAI versions prior to 4.5.128
Systems using PraisonAI MCP integration with user-supplied commands
Environments invoking MCP tools via package runners such as npx -y

Discovery Timeline

April 10, 2026 - CVE-2026-40159 published to NVD
April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40159

Vulnerability Analysis

This vulnerability represents a classic information disclosure flaw (CWE-200) stemming from insecure default behavior in subprocess spawning. When PraisonAI's MCP integration executes user-supplied commands such as MCP("npx -y @smithery/cli ..."), it utilizes Python's subprocess module without sanitizing or restricting the environment variables passed to the child process. The default behavior of subprocess inherits the complete parent process environment, which in AI/ML development environments typically contains numerous sensitive credentials.

The attack surface is particularly concerning in multi-agent AI systems where external packages and tools are frequently invoked. Package runners like npx -y automatically download and execute packages, creating an opportunity for supply chain attacks where compromised or malicious packages can silently harvest the inherited environment variables containing API keys, database credentials, and authentication tokens.

Root Cause

The root cause lies in the default subprocess configuration within PraisonAI's MCP integration code. When spawning subprocesses via Python's subprocess module, the env parameter defaults to inheriting the parent process's full environment if not explicitly restricted. The implementation failed to implement an environment variable allowlist or blocklist mechanism to prevent sensitive credentials from being passed to potentially untrusted external commands.

Attack Vector

The attack requires local access and user interaction to execute. An attacker could exploit this vulnerability through several scenarios:

Malicious MCP Tool Configuration: An attacker tricks a user into configuring an MCP integration with a malicious command that exfiltrates environment variables
Supply Chain Attack: A compromised npm package invoked via npx -y harvests inherited environment variables during execution
Third-Party Package Exploitation: Legitimate but vulnerable packages inadvertently leak environment data to external services

The vulnerability is exploited by crafting or compromising an MCP command or npm package that reads process environment variables (accessible via process.env in Node.js or os.environ in Python subprocesses) and transmits them to an attacker-controlled server.

Detection Methods for CVE-2026-40159

Indicators of Compromise

Unexpected outbound network connections from MCP-spawned subprocesses
Environment variable access patterns in process monitoring logs indicating bulk reads of sensitive variables
Unusual subprocess activity following MCP command execution, particularly involving network communication
Evidence of installed npm packages with unknown or suspicious provenance

Detection Strategies

Monitor subprocess creation events for PraisonAI processes, specifically tracking environment variable inheritance
Implement network egress monitoring to detect data exfiltration attempts from spawned MCP processes
Audit MCP configuration files for suspicious or untrusted command strings
Review npm package dependencies used in MCP commands for known vulnerabilities or signs of compromise

Monitoring Recommendations

Enable detailed subprocess logging in PraisonAI environments to track command execution and environment variable handling
Implement data loss prevention (DLP) rules to detect API keys and credentials in outbound traffic
Configure alerts for new or modified MCP integrations that invoke external package runners
Regularly audit environment variables present in PraisonAI runtime environments to minimize unnecessary credential exposure

How to Mitigate CVE-2026-40159

Immediate Actions Required

Upgrade PraisonAI to version 4.5.128 or later, which contains the security fix
Audit existing MCP configurations for potentially malicious or untrusted command strings
Review and minimize environment variables exposed to PraisonAI processes
Consider running PraisonAI in isolated environments with restricted credential access

Patch Information

The vulnerability is fixed in PraisonAI version 4.5.128. The fix addresses the insecure default environment variable inheritance in MCP subprocess spawning. Organizations should upgrade to this version or later as soon as possible. For additional details, consult the GitHub Security Advisory.

Workarounds

Manually sanitize environment variables before running PraisonAI by creating a restricted environment that excludes sensitive credentials
Avoid using npx -y or similar auto-install package runners in MCP configurations until the patch is applied
Implement network segmentation to prevent MCP subprocesses from making outbound connections to untrusted destinations
Use container isolation or dedicated service accounts with minimal credential access for PraisonAI deployments

bash

# Configuration example - Run PraisonAI with sanitized environment
# Create a minimal environment without sensitive credentials
env -i PATH="$PATH" HOME="$HOME" python -m praison_ai

# Alternatively, use a dedicated environment file with only required variables
export $(cat .env.minimal | xargs) && python -m praison_ai