CVE-2026-40313: PraisonAI Information Disclosure Flaw

CVE-2026-40313 Overview

CVE-2026-40313 is a critical credential leakage vulnerability affecting PraisonAI, a multi-agent teams system. The vulnerability stems from insecure GitHub Actions workflow configurations that are susceptible to the ArtiPACKED attack vector. In versions 4.5.139 and below, the use of actions/checkout without setting persist-credentials: false allows sensitive tokens to be written to the .git/config file, which can then be inadvertently included in uploaded artifacts.

Critical Impact
Attackers with read access to the public PraisonAI repository can download artifacts containing leaked GITHUB_TOKEN and ACTIONS_RUNTIME_TOKEN credentials, enabling malicious code injection, release poisoning, PyPI/Docker package compromise, repository secret theft, and full supply chain attacks affecting all downstream users.

Affected Products

PraisonAI versions 4.5.139 and below
GitHub Actions workflows in .github/workflows/
GitHub Actions in .github/actions/

Discovery Timeline

2026-04-14 - CVE CVE-2026-40313 published to NVD
2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-40313

Vulnerability Analysis

This vulnerability falls under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and represents a significant supply chain security risk. The root issue lies in how GitHub Actions workflows handle credential persistence during the checkout process.

When actions/checkout is used without explicitly setting persist-credentials: false, the action writes authentication tokens (including GITHUB_TOKEN and potentially ACTIONS_RUNTIME_TOKEN) to the .git/config file within the repository workspace. This behavior is intended to facilitate subsequent Git operations within the workflow but creates a dangerous attack surface when combined with artifact uploads.

The vulnerability becomes exploitable when any subsequent workflow step uploads artifacts such as build outputs, logs, or test results. If the artifact upload includes the .git directory or its contents, the embedded tokens become accessible to anyone who can download those artifacts. Since PraisonAI is a public repository, any user with read access can extract these leaked credentials.

Root Cause

The fundamental issue is the default behavior of actions/checkout which persists Git credentials to .git/config for convenience. Combined with artifact upload steps that may inadvertently include the .git directory or files containing these credentials, this creates a credential exposure pathway. The vulnerability spans numerous workflow and action files across the .github/workflows/ and .github/actions/ directories, indicating a systemic configuration weakness rather than an isolated misconfiguration.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability through the following process:

Monitor the public PraisonAI repository for workflow runs that generate artifacts
Download the uploaded artifacts using standard GitHub API access
Extract the artifacts and search for .git/config or other files containing embedded tokens
Use the extracted GITHUB_TOKEN or ACTIONS_RUNTIME_TOKEN to perform privileged operations

With the leaked tokens, an attacker could push malicious commits, create poisoned releases, modify PyPI or Docker packages distributed by the project, access repository secrets, or pivot to compromise downstream systems that depend on PraisonAI.

Detection Methods for CVE-2026-40313

Indicators of Compromise

Unexpected commits or tags appearing in the repository from unfamiliar actors
Unusual workflow runs or modifications to workflow files
Unauthorized changes to release artifacts or package distributions
Anomalous access patterns to repository secrets or sensitive configuration
Evidence of artifact downloads from unknown IP addresses or accounts

Detection Strategies

Audit GitHub Actions workflow logs for unusual artifact upload patterns
Monitor repository audit logs for unexpected authentication events using GITHUB_TOKEN
Implement alerts for modifications to .github/workflows/ or .github/actions/ directories
Review artifact contents for inadvertent inclusion of .git directories or configuration files
Cross-reference artifact download activity with known authorized users

Monitoring Recommendations

Enable GitHub audit logging and configure SIEM integration for repository events
Set up automated scanning of workflow files for insecure actions/checkout configurations
Implement artifact content inspection as part of CI/CD pipeline security checks
Monitor for unauthorized package publications to PyPI, Docker Hub, or other distribution channels
Configure alerts for repository secret access anomalies

How to Mitigate CVE-2026-40313

Immediate Actions Required

Upgrade PraisonAI to version 4.5.140 or later which contains the fix for this vulnerability
Audit all GitHub Actions workflows for actions/checkout usage without persist-credentials: false
Review and rotate any potentially exposed GITHUB_TOKEN or repository secrets
Verify the integrity of recent releases and published packages
Scan previously uploaded artifacts for credential exposure

Patch Information

The vulnerability has been addressed in PraisonAI version 4.5.140. Users should update to this version or later to remediate the issue. For detailed information about the security fix, refer to the GitHub Security Advisory. Additional background on the ArtiPACKED attack vector can be found in the Palo Alto Networks Analysis and The Hacker News coverage.

Workarounds

Add persist-credentials: false to all actions/checkout steps in workflow files
Explicitly exclude .git directories from artifact uploads using path exclusion patterns
Implement pre-upload checks to scan artifact contents for sensitive data
Use GitHub's built-in secret scanning to detect accidentally committed credentials
Consider using short-lived, minimally-scoped tokens where possible instead of default GITHUB_TOKEN

yaml

# Secure actions/checkout configuration example
- uses: actions/checkout@v4
  with:
    persist-credentials: false