CVE-2026-41496: Praison Praisonai SQLi Vulnerability

CVE-2026-41496 Overview

CVE-2026-41496 is a SQL injection vulnerability [CWE-89] in PraisonAI, a multi-agent teams system. The flaw affects praisonai versions prior to 4.6.9 and praisonaiagents versions prior to 1.6.9. An earlier patch for CVE-2026-40315 added input validation only to SQLiteConversationStore, leaving nine sibling backends vulnerable. These backends pass table_prefix directly into f-string SQL statements, creating 52 unvalidated injection points across the codebase. The postgres.py module also accepts an unvalidated schema parameter used directly in Data Definition Language (DDL) statements.

Critical Impact

Authenticated attackers can inject arbitrary SQL across MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, and SurrealDB backends, compromising confidentiality and integrity of agent conversation data.

Affected Products

• praison:praisonai versions prior to 4.6.9
• praison:praisonaiagents (Python) versions prior to 1.6.9
• Nine conversation store backends: MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB

Discovery Timeline

• 2026-05-08 - CVE-2026-41496 published to NVD
• 2026-05-09 - Last updated in NVD database

Technical Details for CVE-2026-41496

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements used in SQL commands. PraisonAI's conversation store layer constructs SQL using Python f-strings that embed the table_prefix parameter directly into queries. When the original fix for CVE-2026-40315 was applied, the maintainers validated input only in SQLiteConversationStore. Nine other backends share the same code pattern but received no input validation. This produced 52 distinct injection sinks across the codebase. Attackers controlling the table_prefix value can break out of identifier context and append arbitrary SQL.

Root Cause

The root cause is the use of Python f-string interpolation to build SQL statements with caller-controlled identifiers. SQL drivers do not parameterize table or schema names, so developers must apply strict allowlist validation. PraisonAI applied this validation to only one backend. The postgres.py backend additionally interpolates a schema parameter into DDL statements such as CREATE SCHEMA and CREATE TABLE, expanding the attack surface beyond DML.

Attack Vector

The attack requires network access and low privileges. An authenticated attacker who can influence the table_prefix or PostgreSQL schema configuration values supplies a crafted string containing SQL metacharacters. The interpolated query executes attacker-controlled SQL with the privileges of the database user configured for the agent backend. Successful exploitation allows reading and modifying stored agent conversations, credentials, and any other tables accessible to the backend role. The vulnerability does not require user interaction.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-rg3h-x3jw-7jm5 for technical details.

Detection Methods for CVE-2026-41496

Indicators of Compromise

• Unexpected SQL syntax errors logged by MySQL, PostgreSQL, Turso, SingleStore, Supabase, or SurrealDB backends used by PraisonAI agents
• Database audit logs showing DROP, CREATE, ALTER, or UNION SELECT statements originating from PraisonAI service accounts
• Anomalous table or schema names containing quotes, semicolons, or SQL keywords in conversation store databases

Detection Strategies

• Inventory all deployments running praisonai or praisonaiagents and compare installed versions against 4.6.9 and 1.6.9 respectively
• Enable query logging on backend databases and alert on statements referencing system tables (information_schema, pg_catalog) from agent service accounts
• Review application configuration sources for any caller-supplied values flowing into table_prefix or PostgreSQL schema parameters

Monitoring Recommendations

• Forward database audit logs and application logs to a centralized analytics platform for correlation with agent activity
• Monitor for sudden spikes in database errors or query latency that may indicate injection probing
• Track configuration changes to PraisonAI conversation store settings through version control and change management systems

How to Mitigate CVE-2026-41496

Immediate Actions Required

• Upgrade praisonai to version 4.6.9 or later and praisonaiagents to version 1.6.9 or later
• Audit all sources that supply table_prefix and PostgreSQL schema values and ensure they originate from trusted configuration, not user input
• Rotate database credentials used by PraisonAI backends if exposure to untrusted input is suspected

Patch Information

The maintainers patched the vulnerability in praisonai 4.6.9 and praisonaiagents 1.6.9. The fix extends input validation to all nine sibling backends and adds validation for the PostgreSQL schema parameter. Refer to the GitHub Security Advisory GHSA-rg3h-x3jw-7jm5 for the complete remediation notes.

Workarounds

• Restrict the database role used by PraisonAI to least privilege, removing DDL permissions where not required
• Hardcode table_prefix and schema values in configuration files rather than accepting them from runtime parameters or environment variables exposed to multi-tenant input
• Place the agent backend behind authentication controls that prevent low-privileged users from modifying conversation store settings