CVE-2026-47399: PraisonAI IDOR breaks workspace

Q: Is CVE-2026-47399 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-47399, increasing the risk of exploitation.

Q: How to fix CVE-2026-47399?

1. Patch immediately: upgrade praisonai-platform from ≤0.1.2 to ≥0.1.4, which adds workspace ownership validation in the service layer. 2. If immediate patching is not possible, restrict platform access to single-tenant mode or limit registration to fully trusted users to eliminate cross-tenant risk. 3. Audit API access logs for requests to workspace-scoped object endpoints where the resolved object UUID belongs to a different workspace than the URL workspace_id—this pattern is diagnostic of exploitation. 4. After patching, inspect all agent configurations for unauthorized modifications to instructions or metadata since the platform was deployed. 5. Rotate any API keys, credentials, or secrets stored in agent instruction fields, as these may have been exfiltrated by an attacker with IDOR access. 6. Add regression tests for negative cross-workspace access cases as recommended in the advisory before deploying future releases.

Q: What systems are affected by CVE-2026-47399?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-tenant agent platforms, Workspace-scoped REST APIs, Collaborative AI agent development environments.

Q: What is the CVSS score for CVE-2026-47399?

CVE-2026-47399 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.29%.

CISO Take

PraisonAI Platform ≤0.1.2 has a systemic Broken Object Level Authorization (BOLA) flaw across workspace-scoped REST routes—agents, projects, issues, and comments—allowing any authenticated user to read, modify, and delete objects belonging to any other workspace by supplying the victim's object UUID in the API URL. This completely breaks multi-tenant isolation: an attacker holding any workspace account can exfiltrate AI agent instructions and configurations, corrupt project state, or destroy agent assets across all tenants in a shared deployment. A functional PoC is published in the GitHub advisory (GHSA-6h6v-6m7w-7vxx), reducing exploitation to a trivial HTTP request; while not yet in CISA KEV, the CVSS 8.8 (network-accessible, low complexity, low privileges) and public working exploit make this a high-urgency patch for any multi-tenant deployment. Upgrade to praisonai-platform 0.1.4 immediately; if patching is delayed, restrict platform access to single-tenant or fully-trusted users only and audit API logs for cross-workspace object ID access patterns.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

CVSS 8.8 (High) accurately reflects the severity: the attack is network-accessible, requires no special complexity, and needs only a valid workspace account—obtainable via self-registration in many deployments. The root cause—service-layer object lookups resolving by global UUID without workspace ownership checks—is trivially exploitable once an attacker holds any account. Blast radius in multi-tenant deployments is total: every workspace's AI agents, projects, issues, and comments are reachable. The published PoC confirms reliable exploitation with a plain HTTP client. EPSS data is not yet available given the recent publication date. Single-tenant or on-premise deployments with strict user enrollment controls face substantially reduced risk, but the vulnerability is still present in the codebase.

How does the attack unfold?

Initial Access

Attacker registers a legitimate account on the PraisonAI Platform instance and creates their own workspace, obtaining a valid authentication token

AML.T0012

Reconnaissance

Attacker discovers victim workspace agent UUIDs through log leakage, error responses, browser developer tools, or a low-privilege insider with workspace access

AML.T0007

Exploitation

Attacker issues authenticated HTTP requests to workspace-scoped API routes using their own workspace ID but the victim's object UUIDs, bypassing authorization through the BOLA flaw

AML.T0049

Impact

Attacker reads sensitive agent instructions, silently modifies agent configurations to insert adversarial instructions, or deletes agents to cause irreversible data loss across victim workspaces

AML.T0081

Initial Access

Attacker registers a legitimate account on the PraisonAI Platform instance and creates their own workspace, obtaining a valid authentication token

AML.T0012

Reconnaissance

Attacker discovers victim workspace agent UUIDs through log leakage, error responses, browser developer tools, or a low-privilege insider with workspace access

AML.T0007

Exploitation

Attacker issues authenticated HTTP requests to workspace-scoped API routes using their own workspace ID but the victim's object UUIDs, bypassing authorization through the BOLA flaw

AML.T0049

Impact

Attacker reads sensitive agent instructions, silently modifies agent configurations to insert adversarial instructions, or deletes agents to cause irreversible data loss across victim workspaces

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 0.1.2	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Patch immediately: upgrade praisonai-platform from ≤0.1.2 to ≥0.1.4, which adds workspace ownership validation in the service layer.
If immediate patching is not possible, restrict platform access to single-tenant mode or limit registration to fully trusted users to eliminate cross-tenant risk.
Audit API access logs for requests to workspace-scoped object endpoints where the resolved object UUID belongs to a different workspace than the URL workspace_id—this pattern is diagnostic of exploitation.
After patching, inspect all agent configurations for unauthorized modifications to instructions or metadata since the platform was deployed.
Rotate any API keys, credentials, or secrets stored in agent instruction fields, as these may have been exfiltrated by an attacker with IDOR access.
Add regression tests for negative cross-workspace access cases as recommended in the advisory before deploying future releases.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Data Leakage Agent Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0081 - Modify AI Agent Configuration AML.T0084 - Discover AI Agent Configuration AML.T0085 - Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

Annex A, A.6 - AI system impact assessment and access controls Clause 6.1.2 - AI risk assessment

NIST AI RMF

GOVERN 1.2 - Accountability structures for AI risk MANAGE 2.4 - Affected parties are notified of risk incidents

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47399?

PraisonAI Platform ≤0.1.2 has a systemic Broken Object Level Authorization (BOLA) flaw across workspace-scoped REST routes—agents, projects, issues, and comments—allowing any authenticated user to read, modify, and delete objects belonging to any other workspace by supplying the victim's object UUID in the API URL. This completely breaks multi-tenant isolation: an attacker holding any workspace account can exfiltrate AI agent instructions and configurations, corrupt project state, or destroy agent assets across all tenants in a shared deployment. A functional PoC is published in the GitHub advisory (GHSA-6h6v-6m7w-7vxx), reducing exploitation to a trivial HTTP request; while not yet in CISA KEV, the CVSS 8.8 (network-accessible, low complexity, low privileges) and public working exploit make this a high-urgency patch for any multi-tenant deployment. Upgrade to praisonai-platform 0.1.4 immediately; if patching is delayed, restrict platform access to single-tenant or fully-trusted users only and audit API logs for cross-workspace object ID access patterns.

Is CVE-2026-47399 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-47399, increasing the risk of exploitation.

How to fix CVE-2026-47399?

1. Patch immediately: upgrade praisonai-platform from ≤0.1.2 to ≥0.1.4, which adds workspace ownership validation in the service layer. 2. If immediate patching is not possible, restrict platform access to single-tenant mode or limit registration to fully trusted users to eliminate cross-tenant risk. 3. Audit API access logs for requests to workspace-scoped object endpoints where the resolved object UUID belongs to a different workspace than the URL workspace_id—this pattern is diagnostic of exploitation. 4. After patching, inspect all agent configurations for unauthorized modifications to instructions or metadata since the platform was deployed. 5. Rotate any API keys, credentials, or secrets stored in agent instruction fields, as these may have been exfiltrated by an attacker with IDOR access. 6. Add regression tests for negative cross-workspace access cases as recommended in the advisory before deploying future releases.

What systems are affected by CVE-2026-47399?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-tenant agent platforms, Workspace-scoped REST APIs, Collaborative AI agent development environments.

What is the CVSS score for CVE-2026-47399?

CVE-2026-47399 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMulti-tenant agent platformsWorkspace-scoped REST APIsCollaborative AI agent development environments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0081 Modify AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

AML.T0085 Data from AI Services

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: Annex A, A.6, Clause 6.1.2

NIST AI RMF: GOVERN 1.2, MANAGE 2.4

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID. The affected pattern appears in workspace-scoped routes such as agents, projects, issues, and comments. The route layer verifies that the caller is a member of the `workspace_id` provided in the URL, but the service layer later resolves the target object by global object ID only. It does not verify that the resolved object actually belongs to the workspace in the URL. As a result, a valid member of `workspace_attacker` can call a route under `/api/v1/workspaces/{workspace_attacker}/...` while supplying an object UUID from `workspace_victim`. The server authorizes the request based on membership in `workspace_attacker`, then fetches or mutates the victim object by global UUID. This breaks the platform's workspace isolation boundary. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

An attacker registers a free account on a shared PraisonAI Platform instance and creates their own workspace, obtaining a valid JWT. They discover victim workspace agent UUIDs through log leakage, error responses, browser developer tools, or a low-privilege insider. Using only their own workspace token, the attacker issues GET /api/v1/workspaces/{attacker_ws}/agents/{victim_agent_uuid} and receives the victim's full agent configuration—system instructions, tool definitions, and operational metadata. The attacker then PATCHes the victim agent to insert adversarial instructions such as data exfiltration commands or jailbreak prompts, which execute silently the next time the victim triggers the agent. Finally, the attacker can DELETE the agent to destroy evidence or cause operational disruption. The entire attack chain requires only standard HTTP requests and a valid account—no memory corruption, no TLS bypass, no elevated privileges.

Weaknesses (CWE)

CWE-284 Improper Access Control Primary CWE-284 Improper Access Control Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-284 Improper Access Control CWE-639 Authorization Bypass Through User-Controlled Key

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.