External risk intelligence

PraisonAI GitHub Workflows Leak Credentials via Artifacts

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-40313

The vulnerability exists within GitHub Actions workflows used during the software development and build process. These workflows are not internet-facing services, appliances, or gateways, but rather internal CI/CD processes that execute during code repository management and build activities.

Praisonai

before 4.5.140

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in PraisonAI's GitHub Actions workflows could expose sensitive credentials, potentially allowing unauthorized code modification and supply chain attacks affecting downstream users.

Developers used a tool that leaked sensitive tokens.
Protects against supply chain compromise risks.
Confirm relevance and exposure in your development lifecycle.

Attack Path

How an attacker could exploit the issue

An attacker could gain access to sensitive tokens embedded in build artifacts, which are inadvertently written to the `.git/config` file by GitHub Actions workflows. If these tokens are then included in uploaded artifacts, an unauthenticated user with read access to the public repository could download them. This could allow the attacker to push malicious code, compromise package repositories, or steal secrets.

No authentication or privileges required.
Uploading build artifacts to the repository.
Token leakage leading to supply chain compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in PraisonAI's GitHub Actions workflows could expose sensitive credentials. When actions/checkout is used without proper configuration, tokens like GITHUB_TOKEN might be written to `.git/config` and subsequently included in uploaded artifacts. If the repository is public, any user with read access could download these artifacts and extract the leaked tokens.

GitHub Actions workflow tokens.
Artifact uploads without credential persistence disabled.
Potential for malicious code injection and supply chain attacks.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI development and security teams are likely responsible for addressing this credential leakage vulnerability. The first practical step is to identify all GitHub Actions workflows that use `actions/checkout` and determine if they are configured with `persist-credentials: false`. This triage process will help prioritize which workflows require immediate attention to prevent potential supply chain compromise.

PraisonAI development and security teams own.
Verify `actions/checkout` credential persistence.
Remediate workflows, coordinate vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI?

PraisonAI is a framework designed for building and managing multi-agent artificial intelligence teams. It acts as a system to orchestrate various AI agents to work together on tasks. Developers use it to streamline complex automation workflows, and its source code is hosted in a public repository on GitHub.

What does CVE-2026-40313 mean in plain English?

This vulnerability involves a weakness known as Inclusion of Functionality from Untrusted Control Sphere (CWE-829). It occurs when the software's automated build processes accidentally save sensitive authentication tokens into configuration files. Because these files are then bundled into build artifacts, unauthorized people can extract the tokens to gain improper access to the project.

How do credentials leak during the build process?

The leak happens when GitHub Actions workflows use the 'actions/checkout' tool without disabling credential persistence. By default, this tool writes sensitive tokens into the local '.git/config' file. If the workflow later uploads build artifacts—such as logs or test results—that include this configuration file, the tokens become part of the publicly accessible package. This does not occur if credential persistence is explicitly disabled.

Is my organization at risk from this PraisonAI issue?

According to Halo Surface Signal, this vulnerability is very unlikely to affect typical internet-facing services because it exists within internal CI/CD processes rather than exposed network appliances. The primary risk is to the software supply chain; if your team relies on PraisonAI, the main concern is whether malicious actors could gain repository access to poison future code releases.

Do I need to update my PraisonAI implementation?

Yes, you should ensure your project is using version 4.5.140 or higher, as this update remediates the credential leakage. If you are managing your own workflows that utilize 'actions/checkout', verify that all instances are configured with 'persist-credentials: false' to prevent tokens from being written to the environment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.