CVE-2026-40159: PraisonAI Information Disclosure Flaw

CVE-2026-40159 Overview

CVE-2026-40159 is a sensitive data exposure vulnerability in PraisonAI, a multi-agent teams system. The vulnerability exists in PraisonAI's MCP (Model Context Protocol) integration, which allows spawning background servers via stdio using user-supplied command strings. When MCP commands are executed through Python's subprocess module, the implementation forwards the entire parent process environment to the spawned subprocess by default. This behavior exposes sensitive data such as API keys, authentication tokens, and database credentials to potentially untrusted or third-party commands.

Critical Impact

Untrusted MCP commands can inherit and access all environment variables from the host process, enabling credential theft and supply chain attacks through silent exfiltration of secrets.

Affected Products

• PraisonAI versions prior to 4.5.128
• Systems using PraisonAI MCP integration with user-supplied commands
• Environments invoking MCP tools via package runners such as npx -y

Discovery Timeline

• April 10, 2026 - CVE-2026-40159 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40159

Vulnerability Analysis

This vulnerability represents a classic information disclosure flaw (CWE-200) stemming from insecure default behavior in subprocess spawning. When PraisonAI's MCP integration executes user-supplied commands such as MCP("npx -y @smithery/cli ..."), it utilizes Python's subprocess module without sanitizing or restricting the environment variables passed to the child process. The default behavior of subprocess inherits the complete parent process environment, which in AI/ML development environments typically contains numerous sensitive credentials.

The attack surface is particularly concerning in multi-agent AI systems where external packages and tools are frequently invoked. Package runners like npx -y automatically download and execute packages, creating an opportunity for supply chain attacks where compromised or malicious packages can silently harvest the inherited environment variables containing API keys, database credentials, and authentication tokens.

Root Cause

The root cause lies in the default subprocess configuration within PraisonAI's MCP integration code. When spawning subprocesses via Python's subprocess module, the env parameter defaults to inheriting the parent process's full environment if not explicitly restricted. The implementation failed to implement an environment variable allowlist or blocklist mechanism to prevent sensitive credentials from being passed to potentially untrusted external commands.

Attack Vector

The attack requires local access and user interaction to execute. An attacker could exploit this vulnerability through several scenarios:

1. Malicious MCP Tool Configuration: An attacker tricks a user into configuring an MCP integration with a malicious command that exfiltrates environment variables
2. Supply Chain Attack: A compromised npm package invoked via npx -y harvests inherited environment variables during execution
3. Third-Party Package Exploitation: Legitimate but vulnerable packages inadvertently leak environment data to external services

The vulnerability is exploited by crafting or compromising an MCP command or npm package that reads process environment variables (accessible via process.env in Node.js or os.environ in Python subprocesses) and transmits them to an attacker-controlled server.

Detection Methods for CVE-2026-40159

Indicators of Compromise

• Unexpected outbound network connections from MCP-spawned subprocesses
• Environment variable access patterns in process monitoring logs indicating bulk reads of sensitive variables
• Unusual subprocess activity following MCP command execution, particularly involving network communication
• Evidence of installed npm packages with unknown or suspicious provenance

Detection Strategies

• Monitor subprocess creation events for PraisonAI processes, specifically tracking environment variable inheritance
• Implement network egress monitoring to detect data exfiltration attempts from spawned MCP processes
• Audit MCP configuration files for suspicious or untrusted command strings
• Review npm package dependencies used in MCP commands for known vulnerabilities or signs of compromise

Monitoring Recommendations

• Enable detailed subprocess logging in PraisonAI environments to track command execution and environment variable handling
• Implement data loss prevention (DLP) rules to detect API keys and credentials in outbound traffic
• Configure alerts for new or modified MCP integrations that invoke external package runners
• Regularly audit environment variables present in PraisonAI runtime environments to minimize unnecessary credential exposure

How to Mitigate CVE-2026-40159

Immediate Actions Required

• Upgrade PraisonAI to version 4.5.128 or later, which contains the security fix
• Audit existing MCP configurations for potentially malicious or untrusted command strings
• Review and minimize environment variables exposed to PraisonAI processes
• Consider running PraisonAI in isolated environments with restricted credential access

Patch Information

The vulnerability is fixed in PraisonAI version 4.5.128. The fix addresses the insecure default environment variable inheritance in MCP subprocess spawning. Organizations should upgrade to this version or later as soon as possible. For additional details, consult the GitHub Security Advisory.

Workarounds

• Manually sanitize environment variables before running PraisonAI by creating a restricted environment that excludes sensitive credentials
• Avoid using npx -y or similar auto-install package runners in MCP configurations until the patch is applied
• Implement network segmentation to prevent MCP subprocesses from making outbound connections to untrusted destinations
• Use container isolation or dedicated service accounts with minimal credential access for PraisonAI deployments

# Configuration example - Run PraisonAI with sanitized environment
# Create a minimal environment without sensitive credentials
env -i PATH="$PATH" HOME="$HOME" python -m praison_ai

# Alternatively, use a dedicated environment file with only required variables
export $(cat .env.minimal | xargs) && python -m praison_ai