# PraisonAI tool_override.py Unauthenticated RCE — CVE-2026-40287 Patch Bypass (CVE-2026-44334)

- **Severity:** Critical
- **Signature ID:** `cdec43c5-5e2c-4083-a2bf-295d5951b987`
- **CVEs:** CVE-2026-40287, CVE-2026-44334
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI05 (Cascading Failures in Multi-Agent Systems), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

PraisonAI lets callers override a tool's execution logic. A flaw in this feature lets an attacker submit a malicious tool definition without logging in, and PraisonAI runs it as-is. This is a bypass of an earlier, incomplete fix for a related bug.

## How the attack works

An attacker sends a request to PraisonAI's tool_override feature containing a tool definition whose 'execution function' is actually attacker-supplied code, such as a shell command or Python snippet. Because the prior patch (for CVE-2026-40287) didn't cover every code path that processes tool overrides, this unauthenticated payload still gets accepted. When the agent later invokes that tool, PraisonAI executes the attacker's code instead of the intended safe handler. The result is remote code execution in the context of the PraisonAI process, with no authentication required.

## Why it matters

An attacker can run arbitrary code on the server hosting PraisonAI, potentially taking full control of the agent process, its credentials, and any systems or data it can reach.

## What you can do

- Restrict network access to PraisonAI's tool_override endpoint so it is not reachable from untrusted networks.
- Check PraisonAI's changelog/advisories and upgrade past the version affected by CVE-2026-44334, since the earlier CVE-2026-40287 fix was incomplete.
- Audit any custom tool_override definitions in use for embedded shell or Python execution primitives that shouldn't be there.
- Monitor logs for tool_override requests containing shell metacharacters, code execution keywords, or explicit CVE references, and treat these as suspicious even if they don't visibly succeed.

## Known benign look-alikes

- Legitimate PraisonAI tool definitions — pattern requires execution primitives alongside tool_override.
- Security advisory text quoting CVE-2026-44334 payloads.
- Tool override schemas using safe function references without code execution.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00545
- https://nvd.nist.gov/vuln/detail/CVE-2026-44334
- https://nvd.nist.gov/vuln/detail/CVE-2026-40287

---
Source: https://www.netzilo.com/threats/atr-praisonai-tool-override-py-unauthenticated-rce-cve-2026-4028