CVE-2026-55530: PraisonAI Authorization Bypass Vulnerability

CVE-2026-55530 Overview

CVE-2026-55530 is a missing authorization vulnerability in PraisonAI, a multi-agent teams system maintained by MervinPraison. Versions of praisonaiagents prior to 1.6.58 expose the ast_grep_rewrite tool without the @require_approval decorator applied to sibling mutation tools. An agent-controlled invocation can pass --update-all combined with a broad path to rewrite matching files on disk without triggering the expected authorization gate. The flaw is tracked under [CWE-862: Missing Authorization]. Version 1.6.58 restores the approval requirement.

Critical Impact
An agent with local execution context can silently modify source files across a project when dry_run=False, bypassing the human-in-the-loop authorization control that governs other mutation tools.

Affected Products

PraisonAI praisonaiagents package prior to version 1.6.58
PraisonAI multi-agent teams system deployments using ast_grep_rewrite
Agent workflows that expose file-mutation tools to LLM-controlled invocation

Discovery Timeline

2026-08-25 - CVE-2026-55530 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55530

Vulnerability Analysis

PraisonAI ships a family of mutation tools that agents can call to modify files on the host filesystem. Sibling tools apply the @require_approval decorator, which forces a human confirmation before destructive actions execute. The ast_grep_rewrite tool omits this decorator entirely.

When an agent invokes ast_grep_rewrite with dry_run=False, the tool proceeds directly to rewrite files matched by the provided pattern. Combined with the --update-all flag and a permissive path argument, a single agent action can mutate arbitrary files within the reachable filesystem scope. The issue is a policy enforcement gap rather than a memory safety flaw.

Root Cause

The root cause is a missing decorator on the ast_grep_rewrite function. The @require_approval control is the project's standard authorization gate for mutation operations, but it was not applied consistently across all sibling tools. Without the decorator, no runtime check compares the requested action against the approval policy before file writes occur.

Attack Vector

Exploitation requires an attacker to influence the agent's tool inputs. Prompt injection through untrusted content, a compromised upstream data source, or a malicious tool description can direct the agent to call ast_grep_rewrite with dry_run=False, --update-all, and a broad target path. User interaction is required to run the agent, but the authorization prompt that would normally intercept the call never fires.

The upstream security patch also hardens adjacent components. The following excerpt adds path-traversal validation to memory user identifiers:

python

    @staticmethod
    def _sanitise_user_id(user_id: str) -> str:
        """Reject path traversal in user_id before using it as a directory name."""
        if not user_id or not isinstance(user_id, str):
            return "default"
        if ".." in user_id or "/" in user_id or "\\" in user_id:
            raise ValueError("user_id must not contain path separators or parent references")
        safe = user_id.strip()
        return safe or "default"

Source: GitHub Commit 2f9677a

A companion change introduces bearer-token authorization on the agent server:

python

    def _authorise_request(self, request) -> bool:
        """Verify bearer token when auth_token is configured."""
        token = self.config.auth_token
        if not token:
            return True
        auth = request.headers.get("Authorization", "")
        if auth.startswith("Bearer ") and auth[7:] == token:
            return True
        return request.headers.get("X-Auth-Token") == token

Source: GitHub Commit 2f9677a

Detection Methods for CVE-2026-55530

Indicators of Compromise

Agent audit logs showing ast_grep_rewrite invocations with dry_run=False and no accompanying approval event
Bulk file modifications with matching timestamps across unrelated project directories
Source-controlled files rewritten outside developer working sessions, often with --update-all scoped to broad paths

Detection Strategies

Compare installed praisonaiagents version against 1.6.58 across development hosts and CI runners
Inspect agent tool-call transcripts for ast_grep_rewrite calls whose parameters include --update-all or root-level paths
Correlate filesystem change events with agent process activity to identify unapproved rewrites

Monitoring Recommendations

Enable verbose agent tool-call logging and forward transcripts to a central analytics store for review
Monitor version control for unattributed bulk commits or working-tree modifications originating from agent processes
Alert on any invocation of mutation tools where the approval decorator did not emit a confirmation record

How to Mitigate CVE-2026-55530

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.58 or later on every host, container image, and CI runner
Audit recent agent runs for ast_grep_rewrite calls with dry_run=False and revert unauthorized file changes from version control
Restrict the filesystem paths available to agent processes using OS-level permissions or sandboxing

Patch Information

The fix is available in PraisonAI release v4.6.58 and applied in commit 2f9677a. Refer to the GitHub Security Advisory GHSA-cfxv-8fw8-rwpv for advisory details.

Workarounds

Disable or remove the ast_grep_rewrite tool from agent tool registries until the upgrade is complete
Force dry_run=True for any rewrite operation via wrapper logic and require operator review before applying diffs
Run agents under least-privileged accounts with write access limited to a dedicated working directory

bash

# Upgrade to the patched release
pip install --upgrade 'praisonaiagents>=1.6.58'

# Verify the installed version
python -c "import praisonaiagents; print(praisonaiagents.__version__)"