CVE-2026-40313: PraisonAI Information Disclosure Flaw

CVE-2026-40313 Overview

CVE-2026-40313 is a critical credential leakage vulnerability affecting PraisonAI, a multi-agent teams system. The vulnerability stems from insecure GitHub Actions workflow configurations that are susceptible to the ArtiPACKED attack vector. In versions 4.5.139 and below, the use of actions/checkout without setting persist-credentials: false allows sensitive tokens to be written to the .git/config file, which can then be inadvertently included in uploaded artifacts.

Critical Impact

Attackers with read access to the public PraisonAI repository can download artifacts containing leaked GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN credentials, enabling malicious code injection, release poisoning, PyPI/Docker package compromise, repository secret theft, and full supply chain attacks affecting all downstream users.

Affected Products

• PraisonAI versions 4.5.139 and below
• GitHub Actions workflows in .github/workflows/
• GitHub Actions in .github/actions/

Discovery Timeline

• 2026-04-14 - CVE CVE-2026-40313 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-40313

Vulnerability Analysis

This vulnerability falls under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and represents a significant supply chain security risk. The root issue lies in how GitHub Actions workflows handle credential persistence during the checkout process.

When actions/checkout is used without explicitly setting persist-credentials: false, the action writes authentication tokens (including GITHUB_TOKEN and potentially ACTIONS_RUNTIME_TOKEN) to the .git/config file within the repository workspace. This behavior is intended to facilitate subsequent Git operations within the workflow but creates a dangerous attack surface when combined with artifact uploads.

The vulnerability becomes exploitable when any subsequent workflow step uploads artifacts such as build outputs, logs, or test results. If the artifact upload includes the .git directory or its contents, the embedded tokens become accessible to anyone who can download those artifacts. Since PraisonAI is a public repository, any user with read access can extract these leaked credentials.

Root Cause

The fundamental issue is the default behavior of actions/checkout which persists Git credentials to .git/config for convenience. Combined with artifact upload steps that may inadvertently include the .git directory or files containing these credentials, this creates a credential exposure pathway. The vulnerability spans numerous workflow and action files across the .github/workflows/ and .github/actions/ directories, indicating a systemic configuration weakness rather than an isolated misconfiguration.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability through the following process:

1. Monitor the public PraisonAI repository for workflow runs that generate artifacts
2. Download the uploaded artifacts using standard GitHub API access
3. Extract the artifacts and search for .git/config or other files containing embedded tokens
4. Use the extracted GITHUB_TOKEN or ACTIONS_RUNTIME_TOKEN to perform privileged operations

With the leaked tokens, an attacker could push malicious commits, create poisoned releases, modify PyPI or Docker packages distributed by the project, access repository secrets, or pivot to compromise downstream systems that depend on PraisonAI.

Detection Methods for CVE-2026-40313

Indicators of Compromise

• Unexpected commits or tags appearing in the repository from unfamiliar actors
• Unusual workflow runs or modifications to workflow files
• Unauthorized changes to release artifacts or package distributions
• Anomalous access patterns to repository secrets or sensitive configuration
• Evidence of artifact downloads from unknown IP addresses or accounts

Detection Strategies

• Audit GitHub Actions workflow logs for unusual artifact upload patterns
• Monitor repository audit logs for unexpected authentication events using GITHUB_TOKEN
• Implement alerts for modifications to .github/workflows/ or .github/actions/ directories
• Review artifact contents for inadvertent inclusion of .git directories or configuration files
• Cross-reference artifact download activity with known authorized users

Monitoring Recommendations

• Enable GitHub audit logging and configure SIEM integration for repository events
• Set up automated scanning of workflow files for insecure actions/checkout configurations
• Implement artifact content inspection as part of CI/CD pipeline security checks
• Monitor for unauthorized package publications to PyPI, Docker Hub, or other distribution channels
• Configure alerts for repository secret access anomalies

How to Mitigate CVE-2026-40313

Immediate Actions Required

• Upgrade PraisonAI to version 4.5.140 or later which contains the fix for this vulnerability
• Audit all GitHub Actions workflows for actions/checkout usage without persist-credentials: false
• Review and rotate any potentially exposed GITHUB_TOKEN or repository secrets
• Verify the integrity of recent releases and published packages
• Scan previously uploaded artifacts for credential exposure

Patch Information

The vulnerability has been addressed in PraisonAI version 4.5.140. Users should update to this version or later to remediate the issue. For detailed information about the security fix, refer to the GitHub Security Advisory. Additional background on the ArtiPACKED attack vector can be found in the Palo Alto Networks Analysis and The Hacker News coverage.

Workarounds

• Add persist-credentials: false to all actions/checkout steps in workflow files
• Explicitly exclude .git directories from artifact uploads using path exclusion patterns
• Implement pre-upload checks to scan artifact contents for sensitive data
• Use GitHub's built-in secret scanning to detect accidentally committed credentials
• Consider using short-lived, minimally-scoped tokens where possible instead of default GITHUB_TOKEN

# Secure actions/checkout configuration example
- uses: actions/checkout@v4
  with:
    persist-credentials: false