CVE-2026-60087 MervinPraison CVE debrief

Who should care

Defenders responsible for PraisonAI deployments should assess exposure and prioritize verification of high-risk tool invocations. Exposure of high-risk tools like write_file requires immediate attention. Defenders must verify the presence of PraisonAI tool approval cache bypass and assess the security impact on their environment. Security teams should review the vulnerability and implement necessary mitigations to prevent security breaches.

Why it matters

PraisonAI's human-in-the-loop tool approval mechanism is vulnerable to cache bypass, allowing potentially dangerous tool invocations with arbitrary arguments without proper review.

• Defenders must verify the presence of PraisonAI tool approval cache bypass
• Exposure of high-risk tools like write_file requires immediate attention
• Arbitrary tool invocations without review can lead to security breaches
• Remediation priority is high due to potential for security breaches

Technical summary

The vulnerability is caused by ApprovalRegistry.is_already_approved in src/praisonai-agents/praisonaiagents/approval/registry.py, which returns True if a tool name is present in a per-run context set, without considering arguments. This allows for arbitrary tool invocations without review, leading to potential security breaches. The vulnerability affects PraisonAI deployments and defenders should prioritize verifying the presence of PraisonAI tool approval cache bypass in their environment and assess exposure of high-risk tools like write_file.

Defensive priority

Defenders should prioritize verifying the presence of PraisonAI tool approval cache bypass in their environment and assess exposure of high-risk tools like write_file.

Recommended defensive actions

• Verify the presence of PraisonAI tool approval cache bypass in your environment
• Assess exposure of high-risk tools like write_file
• Update to version 1.6.78 or later
• Monitor for suspicious tool invocations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by ApprovalRegistry.is_already_approved in src/praisonai-agents/praisonaiagents/approval/registry.py, which returns True if a tool name is present in a per-run context set, without considering arguments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.