CVE-2026-47405: PraisonAI member self-promotes to

Q: Is CVE-2026-47405 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-47405, increasing the risk of exploitation.

Q: How to fix CVE-2026-47405?

1. Upgrade to praisonai-platform 0.1.4 (patched release) immediately — this is the only complete remediation. 2. If upgrade is blocked: restrict workspace membership invitations to fully trusted users only and remove any low-privilege members from sensitive workspaces pending patch. 3. Audit workspace role change history: inspect PATCH /workspaces/{id}/members/{user_id} API logs for calls made by accounts that were not previously owners or admins. 4. Query the members table directly for any accounts holding owner or admin roles that were not explicitly granted by a legitimate owner. 5. Rotate all API keys and secrets accessible within workspaces that had untrusted membership history. 6. Review all workspace owners against expected membership lists and demote any unauthorized escalations found.

Q: What systems are affected by CVE-2026-47405?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration platforms, multi-tenant AI platforms.

Q: What is the CVSS score for CVE-2026-47405?

CVE-2026-47405 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.29%.

CISO Take

PraisonAI Platform ≤0.1.2 has a broken access control flaw where any authenticated low-privilege workspace member can promote themselves—or attacker-controlled accounts—to owner via a single PATCH API call, because privileged workspace management routes use an authorization dependency that defaults to min_role='member' rather than enforcing admin or owner. In an AI agent orchestration context, workspace owner access means full control over AI agent definitions, tool integrations, stored API keys, automation workflows, and all member management within the tenant—a takeover that is silent and leaves no obvious defender signal. While this CVE carries no EPSS score yet and is not in CISA KEV, a fully working self-contained PoC is included in the GitHub Security Advisory (GHSA-h37g-4h4p-9x97), and the package's history of 59 prior CVEs signals systemic security debt that raises the risk profile of any production deployment. Upgrade to praisonai-platform 0.1.4 immediately; if upgrade is delayed, restrict workspace membership to fully trusted users only and audit PATCH /workspaces/{id}/members/{user_id} access logs for unexpected role escalations.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

CVSS 8.8 (High) with network-reachable attack vector, low complexity, and only low privileges required makes this trivially exploitable by any authenticated workspace member—no race condition, special tooling, or administrator action needed. A single PATCH request is the complete exploit, the required user.id is leaked in every normal login response, and a working PoC is publicly documented. Post-exploitation impact is severe: complete workspace takeover including AI agent configurations, tool access, and credential storage. The package's record of 59 prior CVEs elevates confidence that systemic authorization weaknesses exist beyond this specific finding.

How does the attack unfold?

Initial Access

Attacker accepts a low-privilege workspace member invitation to the PraisonAI Platform instance, obtaining a valid JWT token with their user.id embedded in the standard login/register response.

AML.T0012

Privilege Escalation

Attacker sends PATCH /api/v1/workspaces/{id}/members/{self_id} with {"role": "owner"}; the vulnerable require_workspace_member() dependency defaults to min_role='member' and approves the request, returning HTTP 200 with role=owner.

AML.T0049

Persistence

Now as owner, the attacker adds attacker-controlled accounts as additional owners via POST /workspaces/{id}/members and removes the original legitimate owner via DELETE, eliminating all recovery paths.

AML.T0081

Impact

Attacker holds permanent owner control over all AI agents, tool configurations, stored API keys, workspace automation, and member management — enabling data exfiltration, agent sabotage, or lateral movement via agent-accessible external systems.

AML.T0053

Initial Access

Attacker accepts a low-privilege workspace member invitation to the PraisonAI Platform instance, obtaining a valid JWT token with their user.id embedded in the standard login/register response.

AML.T0012

Privilege Escalation

Attacker sends PATCH /api/v1/workspaces/{id}/members/{self_id} with {"role": "owner"}; the vulnerable require_workspace_member() dependency defaults to min_role='member' and approves the request, returning HTTP 200 with role=owner.

AML.T0049

Persistence

Now as owner, the attacker adds attacker-controlled accounts as additional owners via POST /workspaces/{id}/members and removes the original legitimate owner via DELETE, eliminating all recovery paths.

AML.T0081

Impact

Attacker holds permanent owner control over all AI agents, tool configurations, stored API keys, workspace automation, and member management — enabling data exfiltration, agent sabotage, or lateral movement via agent-accessible external systems.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 0.1.2	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

6 steps

Upgrade to praisonai-platform 0.1.4 (patched release) immediately — this is the only complete remediation.
If upgrade is blocked: restrict workspace membership invitations to fully trusted users only and remove any low-privilege members from sensitive workspaces pending patch.
Audit workspace role change history: inspect PATCH /workspaces/{id}/members/{user_id} API logs for calls made by accounts that were not previously owners or admins.
Query the members table directly for any accounts holding owner or admin roles that were not explicitly granted by a legitimate owner.
Rotate all API keys and secrets accessible within workspaces that had untrusted membership history.
Review all workspace owners against expected membership lists and demote any unauthorized escalations found.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI System Operation

NIST AI RMF

GOVERN 1.1 - Policies, Processes and Procedures for AI Risk

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47405?

PraisonAI Platform ≤0.1.2 has a broken access control flaw where any authenticated low-privilege workspace member can promote themselves—or attacker-controlled accounts—to owner via a single PATCH API call, because privileged workspace management routes use an authorization dependency that defaults to min_role='member' rather than enforcing admin or owner. In an AI agent orchestration context, workspace owner access means full control over AI agent definitions, tool integrations, stored API keys, automation workflows, and all member management within the tenant—a takeover that is silent and leaves no obvious defender signal. While this CVE carries no EPSS score yet and is not in CISA KEV, a fully working self-contained PoC is included in the GitHub Security Advisory (GHSA-h37g-4h4p-9x97), and the package's history of 59 prior CVEs signals systemic security debt that raises the risk profile of any production deployment. Upgrade to praisonai-platform 0.1.4 immediately; if upgrade is delayed, restrict workspace membership to fully trusted users only and audit PATCH /workspaces/{id}/members/{user_id} access logs for unexpected role escalations.

Is CVE-2026-47405 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-47405, increasing the risk of exploitation.

How to fix CVE-2026-47405?

1. Upgrade to praisonai-platform 0.1.4 (patched release) immediately — this is the only complete remediation. 2. If upgrade is blocked: restrict workspace membership invitations to fully trusted users only and remove any low-privilege members from sensitive workspaces pending patch. 3. Audit workspace role change history: inspect PATCH /workspaces/{id}/members/{user_id} API logs for calls made by accounts that were not previously owners or admins. 4. Query the members table directly for any accounts holding owner or admin roles that were not explicitly granted by a legitimate owner. 5. Rotate all API keys and secrets accessible within workspaces that had untrusted membership history. 6. Review all workspace owners against expected membership lists and demote any unauthorized escalations found.

What systems are affected by CVE-2026-47405?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration platforms, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-47405?

CVE-2026-47405 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent orchestration platformsmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: GOVERN 1.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to `owner`. The issue is caused by privileged workspace-management routes using the shared dependency `require_workspace_member(...)` without requiring `admin` or `owner`. The dependency defaults to `min_role="member"`, so routes that should be administrative are accessible to ordinary workspace members. As a result, a normal workspace member can promote their own account from `member` to `owner`; add arbitrary users as `owner` or `admin`; change other members' roles; remove legitimate owners or members; take over workspace membership completely; and/or perform destructive workspace operations after escalation. This is a broken access control / vertical privilege escalation vulnerability. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

An attacker receives a low-privilege workspace member invitation to a PraisonAI Platform instance whose AI agents are connected to internal APIs and data sources. Using the JWT token received at login — which includes their user.id in the standard TokenResponse — the attacker sends a single PATCH request to /api/v1/workspaces/{workspace_id}/members/{attacker_user_id} with payload {"role": "owner"}. The request succeeds because the route uses Depends(require_workspace_member) with the default min_role='member', and the membership service performs the update without a second authorization check. Now as owner, the attacker adds two additional attacker-controlled accounts as owners via POST /workspaces/{id}/members, removes the legitimate owner via DELETE /workspaces/{id}/members/{original_owner_id}, and achieves persistent control over all AI agents, tool configurations, stored credentials, and workspace automation — completing a silent full takeover with no alert triggered and no recovery path for the original owner.

Weaknesses (CWE)

CWE-284 Improper Access Control Primary CWE-284 Improper Access Control Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-284 Improper Access Control CWE-862 Missing Authorization

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.