CVE-2026-47409: PraisonAI auth bypass enables owner

Q: Is CVE-2026-47409 actively exploited?

No confirmed active exploitation of CVE-2026-47409 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47409?

1. Patch immediately: upgrade praisonai-platform to ≥ 0.1.4 (the fix gates `remove_member` on `_require_workspace_owner` and adds a last-owner protection check). 2. Audit workspace membership tables for unexpected deletions of owner-role members, particularly those not associated with an admin-initiated action or support ticket. 3. Until patched, alert on HTTP DELETE to `/workspaces/*/members/*` endpoints from tokens whose decoded role is not 'owner' or 'admin'—these requests should be blocked at the WAF or API gateway level as a compensating control. 4. Review all companion workspace-mutation endpoints (add_member, update_member_role, delete_workspace) for the same default-min-role gap described in sibling advisories. 5. Rotate workspace API credentials and re-verify ownership for any tenant where suspicious member-removal activity is detected in audit logs. 6. Enforce network-level access restrictions on the workspace management API to known trusted IP ranges if immediate patching is not feasible.

Q: What systems are affected by CVE-2026-47409?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant platforms, API endpoints.

Q: What is the CVSS score for CVE-2026-47409?

CVE-2026-47409 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.28%.

CISO Take

PraisonAI Platform (praisonai-platform ≤ 0.1.2) allows any authenticated workspace member to permanently remove any other member—including the workspace owner—via a single DELETE request, because the removal endpoint never checks the caller's role and the role-hierarchy enforcement code present in the codebase is simply never invoked on this path. With CVSS 8.1 (High), network-accessible, low complexity, no user interaction required, and a trivial one-request exploit chain (enumerate owner ID via the member list endpoint, issue one DELETE), the barrier to exploitation is essentially zero for any disgruntled or compromised member-tier account; the same package carries 59 prior CVEs, a strong signal of structural security debt that makes companion-advisory chaining—role escalation plus workspace deletion—a realistic follow-on. There is no public exploit and it is not in CISA KEV, but the attack is deterministic and recoverable only via direct database-level admin intervention once the owner is locked out. Upgrade to praisonai-platform ≥ 0.1.4 immediately, audit workspace membership tables for unexpected owner removals, and alert on DELETE requests to `/workspaces/*/members/*` originating from non-owner tokens.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk. Network-accessible endpoint requiring only a valid member-tier credential—the lowest privilege level in the system—with no user interaction and low attack complexity. The exploit is single-request and fully deterministic, making it trivially automatable at scale across all workspaces where an attacker holds any membership token. Integrity and availability impact are both High: ownership of the workspace is irrevocably transferred to the attacker with no self-service recovery path for the victim. The 59 prior CVEs in the same package are a material indicator of systemic security posture issues, elevating the probability of compound exploitation through companion advisories covering role escalation and workspace deletion to achieve full takeover.

How does the attack unfold?

Initial Access

Attacker obtains a valid member-tier JWT for the target PraisonAI workspace via a legitimate account, compromised credential, or invited contractor access.

AML.T0012

Reconnaissance

Attacker calls GET /workspaces/{id}/members—accessible to any member under the same default-role gate—to enumerate all workspace participants and extract the owner's user_id.

AML.T0049

Privilege Exploitation

Attacker issues DELETE /workspaces/{id}/members/{owner_id}; the missing caller-role check allows the member-tier token to pass authorization and delete the owner's membership row from the database.

AML.T0049

Impact

Legitimate workspace owner is permanently locked out; attacker promotes themselves to owner via companion advisory and gains uncontested control over all AI agent configurations, tool bindings, and orchestration workflows in the workspace.

AML.T0048.003

Initial Access

Attacker obtains a valid member-tier JWT for the target PraisonAI workspace via a legitimate account, compromised credential, or invited contractor access.

AML.T0012

Reconnaissance

Attacker calls GET /workspaces/{id}/members—accessible to any member under the same default-role gate—to enumerate all workspace participants and extract the owner's user_id.

AML.T0049

Privilege Exploitation

Attacker issues DELETE /workspaces/{id}/members/{owner_id}; the missing caller-role check allows the member-tier token to pass authorization and delete the owner's membership row from the database.

AML.T0049

Impact

Legitimate workspace owner is permanently locked out; attacker promotes themselves to owner via companion advisory and gains uncontested control over all AI agent configurations, tool bindings, and orchestration workflows in the workspace.

AML.T0048.003

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 0.1.2	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

6 steps

Patch immediately: upgrade praisonai-platform to ≥ 0.1.4 (the fix gates remove_member on _require_workspace_owner and adds a last-owner protection check).
Audit workspace membership tables for unexpected deletions of owner-role members, particularly those not associated with an admin-initiated action or support ticket.
Until patched, alert on HTTP DELETE to /workspaces/*/members/* endpoints from tokens whose decoded role is not 'owner' or 'admin'—these requests should be blocked at the WAF or API gateway level as a compensating control.
Review all companion workspace-mutation endpoints (add_member, update_member_role, delete_workspace) for the same default-min-role gap described in sibling advisories.
Rotate workspace API credentials and re-verify ownership for any tenant where suspicious member-removal activity is detected in audit logs.
Enforce network-level access restrictions on the workspace management API to known trusted IP ranges if immediate patching is not feasible.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Framework AML.T0012 - Valid Accounts AML.T0048.003 - User Harm AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2.3 - Access control for AI systems

NIST AI RMF

GOVERN 1.6 - Organizational policies for AI risk management

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47409?

PraisonAI Platform (praisonai-platform ≤ 0.1.2) allows any authenticated workspace member to permanently remove any other member—including the workspace owner—via a single DELETE request, because the removal endpoint never checks the caller's role and the role-hierarchy enforcement code present in the codebase is simply never invoked on this path. With CVSS 8.1 (High), network-accessible, low complexity, no user interaction required, and a trivial one-request exploit chain (enumerate owner ID via the member list endpoint, issue one DELETE), the barrier to exploitation is essentially zero for any disgruntled or compromised member-tier account; the same package carries 59 prior CVEs, a strong signal of structural security debt that makes companion-advisory chaining—role escalation plus workspace deletion—a realistic follow-on. There is no public exploit and it is not in CISA KEV, but the attack is deterministic and recoverable only via direct database-level admin intervention once the owner is locked out. Upgrade to praisonai-platform ≥ 0.1.4 immediately, audit workspace membership tables for unexpected owner removals, and alert on DELETE requests to `/workspaces/*/members/*` originating from non-owner tokens.

Is CVE-2026-47409 actively exploited?

No confirmed active exploitation of CVE-2026-47409 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47409?

1. Patch immediately: upgrade praisonai-platform to ≥ 0.1.4 (the fix gates `remove_member` on `_require_workspace_owner` and adds a last-owner protection check). 2. Audit workspace membership tables for unexpected deletions of owner-role members, particularly those not associated with an admin-initiated action or support ticket. 3. Until patched, alert on HTTP DELETE to `/workspaces/*/members/*` endpoints from tokens whose decoded role is not 'owner' or 'admin'—these requests should be blocked at the WAF or API gateway level as a compensating control. 4. Review all companion workspace-mutation endpoints (add_member, update_member_role, delete_workspace) for the same default-min-role gap described in sibling advisories. 5. Rotate workspace API credentials and re-verify ownership for any tenant where suspicious member-removal activity is detected in audit logs. 6. Enforce network-level access restrictions on the workspace management API to known trusted IP ranges if immediate patching is not feasible.

What systems are affected by CVE-2026-47409?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant platforms, API endpoints.

What is the CVSS score for CVE-2026-47409?

CVE-2026-47409 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant platformsAPI endpoints

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0048.003 User Harm

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2.3

NIST AI RMF: GOVERN 1.6

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The `DELETE /workspaces/{workspace_id}/members/{user_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member can remove any other member, including the workspace owner, using a single DELETE. There is no caller-role check, no target-role check, no "cannot remove last owner" guard. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

An attacker with a legitimate 'member' role in a shared PraisonAI workspace—a contractor, former employee, or owner of a compromised account—calls `GET /workspaces/{id}/members` (accessible by any member under the same default-gate logic) to enumerate all workspace members and retrieve the workspace owner's `user_id`. The attacker then sends `DELETE /workspaces/{id}/members/{owner_user_id}` with their member JWT. The request passes authentication (valid token), bypasses authorization (no role check exists), and the owner's membership row is deleted. The owner immediately receives HTTP 403 on any subsequent workspace request with no in-application recourse. The attacker then invokes the companion `update_member_role` advisory to promote their account to 'owner', gaining uncontested administrative control over all AI agent configurations, tool definitions, API key bindings, and orchestration pipelines in the workspace—with the original owner unable to recover access outside of direct database-level intervention by a platform administrator.

Weaknesses (CWE)

CWE-269 Improper Privilege Management Primary CWE-269 Improper Privilege Management Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-269 Improper Privilege Management CWE-862 Missing Authorization

CWE-269 — Improper Privilege Management: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system.

Source: MITRE CWE corpus.