PraisonAI: Authorization bypass in Slack app_mention handler
Summary
The Slack bot of PraisonAI (PyPI package praisonai) from version 3.11.0 before 4.6.59 does not apply its configured allowed_users, allowed_channels and unknown_user_policy checks to Slack app_mention events. A Slack workspace user who can mention the bot in a channel where the app is present can send prompts to the configured agent, even if the sender or the channel is not allowed. The actual impact depends on the agent's tools and data access and may affect confidentiality and integrity. The attacker needs a Slack account in the workspace.
Affected
- PraisonAI (pip package praisonai) from 3.11.0 before 4.6.59, Slack bot component
- Advisory range per GHSA: >= 3.11.0, <= 4.6.58
Fixed in
- Upgrade to praisonai 4.6.59 or later.
Workaround
Unknown. No workaround is documented by the vendor.
Exploitation
- CISA SSVC lists exploitation as 'poc' (proof of concept available) and automatable as 'no'.
- No exploitation in the wild is known.
- Public PoC status is unclear.
Our recommendation
- Check whether PraisonAI with the Slack bot is deployed and which version is installed.
- Upgrade to praisonai 4.6.59 or later.
- Until the upgrade, limit the Slack channels where the app is installed and restrict who can mention the bot.
- Review the tools granted to the bot agent and disable the bot if it uses sensitive tools.
- Monitor bot activity for prompts from unknown Slack users.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qvpf-j64c-jmhr github.com
- OSV: GHSA-qvpf-j64c-jmhr osv.dev
- Strix CVE overview CVE-2026-56835 www.strix.ai
- Vulners NVD record CVE-2026-56835 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:16.
Original description (NVD)
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.