CVE-2026-56835 in PraisonAI
Summary
by MITRE • 10/23/2026
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within PraisonAI versions ranging from 3.11.0 to just before 4.6.59 represents a critical access control bypass rooted in inconsistent event handling logic across different Slack API endpoints. As a multi-agent team system, PraisonAI relies on strict configuration policies to determine which users and channels are permitted to interact with its automated agents. These security controls include the allowed_users list, the allowed_channels list, and an unknown_user_policy setting that dictates how unverified or unauthorized entities should be treated. In this specific implementation flaw, the application correctly enforces these restrictions when processing standard Slack message events through its primary event handler. However, a parallel code path exists for handling app_mention events, which are triggered specifically when a user tags or mentions the bot within a channel where it is installed. The critical technical failure lies in the fact that this adjacent event handler fails to apply the same authorization checks applied by the normal message handler. This discrepancy creates an authentication bypass scenario where security policies defined at the application level are effectively ignored for mention-based interactions, allowing unauthorized execution of agent functions.
From a technical perspective, this flaw constitutes an Authorization Bypass through User Control weakness, commonly categorized under CWE-285 in industry standards. The root cause is not a failure in cryptographic verification or input validation per se, but rather a logical error in the access control matrix implementation. When a Slack workspace user mentions the bot, the application routes the request to a specific handler that lacks the necessary checks against BotConfig.allowed_users and BotConfig.allowed_channels. Consequently, even if an individual is explicitly excluded from the allowed users list or interacts within a channel not whitelisted by administrators, they can still trigger PraisonAI agents simply by using the mention syntax. Furthermore, this bypass remains effective regardless of whether the unknown_user_policy is set to deny, as the handler responsible for processing mentions does not consult these policy settings before executing agent logic. This inconsistency suggests that developers may have implemented security controls in one part of the codebase without ensuring parity across all entry points, a common pitfall in complex event-driven architectures where multiple handlers manage similar but distinct input types.
The operational impact of this vulnerability is significant for organizations relying on PraisonAI to automate sensitive workflows or handle proprietary data within Slack workspaces. An attacker with basic access to the Slack workspace can exploit this flaw to invoke AI agents without proper authorization, potentially leading to unauthorized data exposure if the agent processes and returns information from restricted sources. It also opens the door to abuse of computational resources, as an adversary could trigger repeated agent executions for denial-of-service purposes or manipulate outputs by providing malicious prompts through the unguarded mention channel. Since Slack mentions are a primary method of interaction in many collaborative environments, this vulnerability effectively neutralizes the intended access control boundaries, allowing any user with visibility into the bot to interact with it directly. This undermines the principle of least privilege and compromises the integrity of automated decision-making processes managed by the AI agents.
To mitigate this risk, organizations must ensure they are running PraisonAI version 4.6.59 or later, where the developers have patched this inconsistency by aligning the authorization logic in the app_mention handler with that of the standard message handler. Until an upgrade is feasible, administrators should consider restricting bot permissions at the Slack platform level rather than relying solely on application-level configurations. This includes limiting which users can install apps and ensuring that sensitive channels do not have the PraisonAI bot installed if possible. Additionally, monitoring logs for unusual spikes in app_mention events could help detect potential exploitation attempts while a patch is being deployed. Long-term remediation strategies should involve implementing comprehensive security testing that specifically targets edge cases in event handling to ensure all code paths enforce identical access control policies, thereby preventing similar authorization bypasses in future updates or related systems.