Live › vulnerability › CVE-2026-56835
Go to dashboardPraisonAI's Slack bot enforces its allowed_users, allowed_channels and unknown-user deny policy only in the normal message handler, not in the app_mention handler. A Slack workspace user can therefore trigger the configured agent by mentioning the bot in a channel, even when those policies should block them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run the PraisonAI Slack bot integration on a version from before . Any Slack workspace member who can mention the bot in a channel where the app is installed can reach the agent, so the exposure is the workspace membership rather than the public internet. Teams not using the Slack bot, or already on or later, can skip it.
3.11.04.6.594.6.59No product ranges from the sources yet.
3.11.0 up to, but not including, 4.6.59.BotConfig allowed_users, allowed_channels or unknown_user_policy="deny"; if it is not running the Slack integration, it is not exposed.4.6.59 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.
This page as .md · .json · in your agent: get_signal("CVE-2026-56835")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.