CVE-2026-41496

PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass table_prefix straight into f-string SQL. Same root cause, same code pattern, same exploitation. 52 unvalidated injection points across the codebase. postgres.py additionally accepts an unvalidated schema parameter used directly in DDL. This issue has been patched in praisonai version 4.6.9 and praisonaiagents version 1.6.9.

• CWE-89

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rg3h-x3jw-7jm5Exploit, Vendor Advisory
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rg3h-x3jw-7jm5Exploit, Vendor Advisory

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4149Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code …9.8
• CVE-2026-41490Dagster is an orchestration platform for the development, pr…8.3
• CVE-2026-41491Dapr is a portable, event-driven, runtime for building distr…8.1
• CVE-2026-41492Dgraph is an open source distributed GraphQL database. Prior…9.8
• CVE-2026-41493YARD is a Ruby Documentation tool. Prior to version 0.9.42, …7.5
• CVE-2026-41495n8n-MCP is an MCP server that provides AI assistants access …5.3
• CVE-2026-41497PraisonAI is a multi-agent teams system. Prior to version 4.…9.8
• CVE-2026-41498Kimai is an open-source time tracking application. Prior to …3.3
• CVE-2026-41499Wazuh is a free and open source platform used for threat pre…6.5
• CVE-2026-4150GIMP PSD File Parsing Integer Overflow Remote Code Execution…7.8
• CVE-2026-41500electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…9.8
• CVE-2026-41501electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…9.8