CVE-2026-47406: PraisonAI IDOR enables

Q: Is CVE-2026-47406 actively exploited?

No confirmed active exploitation of CVE-2026-47406 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47406?

1. Patch to praisonai-platform 0.1.4 immediately — this is the primary remediation. 2. If patching cannot be executed immediately, network-restrict the dependency API endpoints (/workspaces/*/issues/*/dependencies) to internal trusted networks only. 3. Audit dependency creation logs for anomalies: flag any requests where issue_id or depends_on_issue_id in the request path or body does not belong to the authenticated user's workspace. 4. Implement runtime monitoring for issue IDs appearing in request bodies that resolve to foreign workspace records — this should not occur in a correctly authorized system. 5. If cross-workspace dependency pollution is suspected, rotate all workspace member tokens in affected tenants and audit dependency graphs for attacker-injected blocking relationships.

Q: What systems are affected by CVE-2026-47406?

This vulnerability affects the following AI/ML architecture patterns: AI agent platforms, multi-tenant SaaS, issue tracking for AI workflows, AI project management systems.

Q: What is the CVSS score for CVE-2026-47406?

CVE-2026-47406 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.23%.

CISO Take

CVE-2026-47406 is an Insecure Direct Object Reference flaw in praisonai-platform where a valid workspace member token is sufficient to read, write, and delete issue dependencies across every tenant on the platform — there is no ownership check at the service layer despite a route-level membership gate. For CISOs running AI agent workflows on PraisonAI, the blast radius is significant: a single low-privilege contractor account can corrupt dependency graphs in workspaces they have never been invited to, and a single POST request can poison two foreign workspaces simultaneously. This package has accumulated 59 CVEs, a pattern signaling systemic security debt rather than isolated bugs. Patch immediately to praisonai-platform 0.1.4; if patching is not immediately feasible, network-restrict the dependency API endpoints to trusted internal networks only.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

The CVSS score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a low exploitation bar: an attacker needs only a valid workspace member credential, no special configuration, no user interaction, and no complex attack chain. For multi-tenant deployments — the primary model for SaaS AI agent platforms — the effective impact is significantly higher than the base score suggests, since the scope limitation (S:U) does not capture cross-tenant data integrity violation. Single-tenant deployments face lower risk as lateral movement stays within a single organization boundary. There is no public proof-of-concept exploit at time of publication, but the advisory includes a complete code walkthrough of the vulnerable path, reducing attacker development time to near zero and making this functionally PoC-quality disclosure. EPSS data is not yet available given the recency of the advisory.

How does the attack unfold?

Workspace Enrollment

Attacker registers as a legitimate member of an attacker-controlled workspace, obtaining a valid JWT with workspace_member role that passes the route-level require_workspace_member check.

AML.T0012

Foreign UUID Harvesting

Attacker collects foreign workspace issue UUIDs leaked via agent prompt history, activity feeds, shared context windows, or error responses that serialize internal issue IDs from other tenants.

AML.T0049

Cross-Workspace IDOR Execution

Attacker POSTs to /workspaces/{attacker_workspace_id}/issues/{foreign_issue_id}/dependencies with body depends_on_issue_id pointing to a second foreign issue — membership check passes, DependencyService.create performs zero ownership validation on either ID.

AML.T0049

Multi-Tenant Integrity Compromise

Foreign workspaces' dependency graphs are poisoned with attacker-injected blocking relationships, freezing issue closure workflows, halting AI deployment pipelines, and leaking project topology across tenant boundaries.

AML.T0085.001

Workspace Enrollment

Attacker registers as a legitimate member of an attacker-controlled workspace, obtaining a valid JWT with workspace_member role that passes the route-level require_workspace_member check.

AML.T0012

Foreign UUID Harvesting

Attacker collects foreign workspace issue UUIDs leaked via agent prompt history, activity feeds, shared context windows, or error responses that serialize internal issue IDs from other tenants.

AML.T0049

Cross-Workspace IDOR Execution

Attacker POSTs to /workspaces/{attacker_workspace_id}/issues/{foreign_issue_id}/dependencies with body depends_on_issue_id pointing to a second foreign issue — membership check passes, DependencyService.create performs zero ownership validation on either ID.

AML.T0049

Multi-Tenant Integrity Compromise

Foreign workspaces' dependency graphs are poisoned with attacker-injected blocking relationships, freezing issue closure workflows, halting AI deployment pipelines, and leaking project topology across tenant boundaries.

AML.T0085.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 0.1.2	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

5 steps

Patch to praisonai-platform 0.1.4 immediately — this is the primary remediation.
If patching cannot be executed immediately, network-restrict the dependency API endpoints (/workspaces/*/issues/*/dependencies) to internal trusted networks only.
Audit dependency creation logs for anomalies: flag any requests where issue_id or depends_on_issue_id in the request path or body does not belong to the authenticated user's workspace.
Implement runtime monitoring for issue IDs appearing in request bodies that resolve to foreign workspace records — this should not occur in a correctly authorized system.
If cross-workspace dependency pollution is suspected, rotate all workspace member tokens in affected tenants and audit dependency graphs for attacker-injected blocking relationships.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent API AML.T0012 - Valid Accounts AML.T0048.001 - Reputational Harm AML.T0049 - Exploit Public-Facing Application AML.T0085.001 - AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.2 - Access control for AI system resources

NIST AI RMF

GOVERN-1.1 - Policies for AI risk management

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-47406?

CVE-2026-47406 is an Insecure Direct Object Reference flaw in praisonai-platform where a valid workspace member token is sufficient to read, write, and delete issue dependencies across every tenant on the platform — there is no ownership check at the service layer despite a route-level membership gate. For CISOs running AI agent workflows on PraisonAI, the blast radius is significant: a single low-privilege contractor account can corrupt dependency graphs in workspaces they have never been invited to, and a single POST request can poison two foreign workspaces simultaneously. This package has accumulated 59 CVEs, a pattern signaling systemic security debt rather than isolated bugs. Patch immediately to praisonai-platform 0.1.4; if patching is not immediately feasible, network-restrict the dependency API endpoints to trusted internal networks only.

Is CVE-2026-47406 actively exploited?

No confirmed active exploitation of CVE-2026-47406 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47406?

1. Patch to praisonai-platform 0.1.4 immediately — this is the primary remediation. 2. If patching cannot be executed immediately, network-restrict the dependency API endpoints (/workspaces/*/issues/*/dependencies) to internal trusted networks only. 3. Audit dependency creation logs for anomalies: flag any requests where issue_id or depends_on_issue_id in the request path or body does not belong to the authenticated user's workspace. 4. Implement runtime monitoring for issue IDs appearing in request bodies that resolve to foreign workspace records — this should not occur in a correctly authorized system. 5. If cross-workspace dependency pollution is suspected, rotate all workspace member tokens in affected tenants and audit dependency graphs for attacker-injected blocking relationships.

What systems are affected by CVE-2026-47406?

This vulnerability affects the following AI/ML architecture patterns: AI agent platforms, multi-tenant SaaS, issue tracking for AI workflows, AI project management systems.

What is the CVSS score for CVE-2026-47406?

CVE-2026-47406 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

AI agent platformsmulti-tenant SaaSissue tracking for AI workflowsAI project management systems

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0048.001 Reputational Harm

AML.T0049 Exploit Public-Facing Application

AML.T0085.001 AI Agent Tools

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.2

NIST AI RMF: GOVERN-1.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endpoints (`POST/GET /workspaces/{workspace_id}/issues/{issue_id}/dependencies` and `DELETE .../dependencies/{dep_id}`) gate access on `require_workspace_member(workspace_id)` only, then dispatch to `DependencyService` calls that take URL/body-supplied issue and dependency IDs without verifying any of them belong to the membership-checked workspace. Most damaging: `create_dependency` accepts `body.depends_on_issue_id` from the request body — that ID is checked against nothing — letting an attacker create a "blocks" or "related" link between any two issues anywhere in the database. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

A contractor is granted a legitimate seat in an attacker-controlled workspace on a shared PraisonAI platform instance. During normal platform activity — browsing shared agent context windows, reading activity feeds, or observing error responses that serialize internal issue UUIDs — the attacker harvests foreign workspace issue IDs from a target organization also using the platform. With two foreign issue UUIDs in hand, the attacker sends a single authenticated POST to /workspaces/{attacker_workspace_id}/issues/{foreign_issue_A}/dependencies with body {"depends_on_issue_id": "{foreign_issue_B}"}. The route-level workspace membership check passes; DependencyService.create never validates that either ID belongs to the attacker's workspace. The result is a phantom blocking relationship injected between two issues in the target's workspace — their critical AI model deployment issue now shows as blocked by an unrelated issue, halting their release pipeline until the poisoned dependency is manually detected and removed.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.