PraisonAI: Improper approval validation in DiscordApproval for dangerous tool calls
Summary
PraisonAI's DiscordApproval backend approves a pending dangerous tool call when any later non-bot message in the configured Discord channel reads as an approval, such as "yes". The approval is not bound to a reply, thread, approver identity or request-specific token. Any user who can post in the approval channel can therefore approve high-risk tool calls such as shell commands, file writes or deployments, which run with the privileges of the PraisonAI process.
Affected
- PraisonAI versions >= 4.5.2 and <= 4.6.58
- Only deployments that use DiscordApproval for dangerous tools are affected.
Fixed in
- Fixed in PraisonAI 4.6.59.
Workaround
- Unknown. No vendor workaround is documented for the Discord approval handling.
Exploitation
- A public proof-of-concept exists (local PoV script in the repository, mocks Discord API calls).
- No confirmed exploitation in the wild and no CISA KEV listing known.
- CISA SSVC: Exploitation poc, Automatable no, Technical Impact total.
Our recommendation
- Upgrade PraisonAI to version 4.6.59 or later.
- Until the upgrade, restrict the approval channel to the approver and the bot, and remove members who should not approve.
- Do not rely on Discord approvals for high-risk tools.
- Review logs for approvals of dangerous tool calls that no authorised person requested or reviewed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8579-rgg5-ph2m github.com
- OSV GHSA-8579-rgg5-ph2m osv.dev
- Positive Technologies PT-2026-61757 dbugs.ptsecurity.com
- NVD record via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:50.
Original description (NVD)
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.