PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth_token is configured (the default). By adding dangerous tool names (e.g., shell_exec, file_write) to the allowlist, an attacker can cause the ExecApprovalManager to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce. This vulnerability is fixed in 4.5.128.

Affected: PyPI: PraisonAI

## Summary

The gateway's `/api/approval/allow-list` endpoint permits unauthenticated modification of the tool approval allowlist when no `auth_token` is configured (the default). By adding dangerous tool names (e.g., `shell_exec`, `file_write`) to the allowlist, an attacker can cause the `ExecApprovalManager` to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce.

## Details

The vulnerability arises from the interaction of three components:

**1. Authentication bypass in default config**

`_check_auth()` in `server.py:243-246` returns `None` (no error) when `self.config.auth_token` is falsy:

```python # server.py:243-246 def _check_auth(request) -> Optional[JSONResponse]: if not self.config.auth_token: return None # No auth configured → allow everything ```

`GatewayConfig` defaults `auth_token` to `None` (`config.py:61`):

```python # config.py:61 auth_token: Optional[str] = None ```

**2. Unrestricted allowlist modification**

The `approval_allowlist` handler at `server.py:381-420` calls `_check_auth()` and proceeds when it returns `None`:

```python # server.py:388-410 auth_err = _check_auth(request) if auth_err: return auth_err # ... if request.method == "POST": _approval_mgr.allowlist.add(tool_name) # No validation on tool_name return JSONResponse({"added": tool_name}) ```

There is no validation that `tool_name` corresponds t…

Affected: PyPI: praisonai

## Summary

The gateway's `/api/approval/allow-list` endpoint permits unauthenticated modification of the tool approval allowlist when no `auth_token` is configured (the default). By adding dangerous tool names (e.g., `shell_exec`, `file_write`) to the allowlist, an attacker can cause the `ExecApprovalManager` to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce.

## Details

The vulnerability arises from the interaction of three components:

**1. Authentication bypass in default config**

`_check_auth()` in `server.py:243-246` returns `None` (no error) when `self.config.auth_token` is falsy:

```python # server.py:243-246 def _check_auth(request) -> Optional[JSONResponse]: if not self.config.auth_token: return None # No auth configured → allow everything ```

`GatewayConfig` defaults `auth_token` to `None` (`config.py:61`):

```python # config.py:61 auth_token: Optional[str] = None ```

**2. Unrestricted allowlist modification**

The `approval_allowlist` handler at `server.py:381-420` calls `_check_auth()` and proceeds when it returns `None`:

```python # server.py:388-410 auth_err = _check_auth(request) if auth_err: return auth_err # ... if request.method == "POST": _approval_mgr.allowlist.add(tool_name) # No validation on tool_name return JSONResponse({"added": tool_name}) ```

There is no validation that `tool_name` corresponds t…