CVE-2026-60087 Overview
CVE-2026-60087 affects PraisonAI versions before 1.6.78. The framework caches tool approval decisions by tool name only. This design flaw allows attackers to reuse an initial user approval for subsequent invocations of the same tool with arbitrary arguments. An attacker obtains approval for a benign operation, then executes dangerous file write operations with unreviewed parameters within the same session. The weakness is categorized as [CWE-863] Incorrect Authorization. The flaw requires local access and user interaction to trigger the initial approval, but subsequent malicious calls bypass any further review by the operator.
Critical Impact
Attackers can perform arbitrary file write operations by reusing a cached approval granted for an unrelated benign tool call in the same PraisonAI session.
Affected Products
- PraisonAI versions prior to 1.6.78
- Deployments relying on the built-in tool approval workflow
- AI agent sessions that reuse approved tool names for multiple operations
Discovery Timeline
- 2026-07-15 - CVE-2026-60087 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-60087
Vulnerability Analysis
PraisonAI implements a human-in-the-loop approval mechanism for sensitive tool executions performed by AI agents. When a tool is invoked, the framework prompts the operator to approve or deny the call. Versions before 1.6.78 store the approval decision keyed by the tool name alone, ignoring the argument set supplied at approval time.
Once a tool name is cached as approved, later invocations of that same tool skip the prompt regardless of the parameters passed. This breaks the trust boundary between the operator and the agent because argument-level review is discarded after the first approval within the session.
The flaw sits in the authorization logic rather than in input parsing, which is why it maps to [CWE-863]. See the GitHub Security Advisory GHSA-29r9-67vg-qj56 for maintainer details.
Root Cause
The approval cache uses the tool identifier as its sole key. Arguments, file paths, target hosts, and command payloads are not incorporated into the cache lookup. Any semantic check performed by the operator during the first approval applies only to that specific parameter set, but the cache treats all future calls as pre-authorized.
Attack Vector
An attacker who influences agent behavior, through prompt injection, a malicious plugin, or a compromised data source, requests a benign call to a file write tool. The operator approves the harmless action. The attacker then instructs the agent to reuse the same tool with paths targeting configuration files, credentials, or startup scripts. No new approval is requested. The VulnCheck Advisory describes this reuse pattern.
The vulnerability is not exploitable remotely without local session access, and no public exploit is available at publication.
Detection Methods for CVE-2026-60087
Indicators of Compromise
- Unexpected file writes to sensitive paths originating from a PraisonAI agent process
- Session logs showing multiple invocations of the same tool with divergent argument sets after a single approval event
- Agent transcripts containing prompt injection payloads that reference file write tools
Detection Strategies
- Instrument PraisonAI tool calls to log every invocation with full arguments, not only approval events, and diff arguments across calls sharing a cached approval
- Alert when an approved tool is subsequently called with arguments targeting sensitive paths such as ~/.ssh, /etc, or application configuration directories
- Correlate agent prompt content with tool argument changes to identify injection-driven parameter mutation
Monitoring Recommendations
- Enable file integrity monitoring on directories writable by the account running PraisonAI
- Ship PraisonAI session logs and tool execution telemetry to a centralized data lake for retrospective hunting
- Track the installed PraisonAI version across hosts and flag any instance below 1.6.78
How to Mitigate CVE-2026-60087
Immediate Actions Required
- Upgrade PraisonAI to version 1.6.78 or later on all hosts and containers running agent workloads
- Restart agent sessions after upgrade so cached approvals from vulnerable builds are discarded
- Restrict the filesystem permissions of the account executing PraisonAI to the minimum required paths
Patch Information
The maintainers resolved the issue in PraisonAI 1.6.78. The fix changes the approval cache to consider tool arguments so that each distinct parameter set requires its own operator decision. Refer to the GitHub Security Advisory for release notes and commit references.
Workarounds
- Disable approval caching entirely and require operator confirmation for every tool call in sessions that cannot be upgraded immediately
- Run PraisonAI under a dedicated low-privilege user with no write access to sensitive configuration or credential paths
- Sandbox agent execution using containers or seccomp profiles that restrict writable directories
# Upgrade PraisonAI to the patched release
pip install --upgrade 'praisonai>=1.6.78'
# Verify the installed version
python -c "import praisonai; print(praisonai.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
