CVE-2026-47412: PraisonAI member can wipe entire

Q: Is CVE-2026-47412 actively exploited?

No confirmed active exploitation of CVE-2026-47412 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47412?

1. Patch immediately: upgrade praisonai-platform to 0.1.4, which restricts DELETE /workspaces/{workspace_id} to owner-role only. 2. If patching is blocked: add a WAF or API gateway rule to deny DELETE requests to /workspaces/* for tokens without owner-level claims. 3. Audit all workspace memberships and revoke unexpected or untrusted members. 4. Implement workspace data backups as a compensating control — the vulnerability has no soft-delete or recovery mechanism. 5. Enable API access logging on /workspaces/* DELETE methods and alert on any invocations pending patching. 6. Review companion endpoints (update_workspace, add_member, update_member_role, remove_member) flagged in the advisory as sharing the same default-min-role gap and apply the same owner-role tightening.

Q: What systems are affected by CVE-2026-47412?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, collaborative AI agent workflows, AI orchestration platforms.

Q: What is the CVSS score for CVE-2026-47412?

CVE-2026-47412 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.28%.

CISO Take

PraisonAI Platform's workspace deletion endpoint lacks any owner-role gate, allowing any workspace member — regardless of privilege level — to issue a single HTTP DELETE and irreversibly destroy the entire workspace including all projects, agents, issues, comments, and member records via cascading database deletion. The blast radius is total: no soft-delete, no confirmation prompt, no audit trail (the activity log is also cascade-deleted), and no recovery path exists. With a CVSS of 8.1, low-complexity exploitation, and only a standard member token required, any invited collaborator or compromised account can execute this in seconds with no technical expertise. Organizations running praisonai-platform in multi-tenant or collaborative AI agent environments should patch to version 0.1.4 immediately; if patching is blocked, restrict workspace membership to fully trusted users and add an API gateway rule blocking DELETE on /workspaces/* endpoints for non-owner tokens.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

High. CVSS 8.1 reflects a network-accessible, low-complexity exploit requiring only low privileges and no user interaction. The attack surface is every workspace with more than one member, and the destructive impact — irreversible deletion of all workspace data — is disproportionate to the access level required. Multi-tenant deployments and collaborative AI agent pipelines face the greatest exposure. Not currently in CISA KEV, but the trivial exploit chain, severe availability and integrity impact, and absence of any recovery mechanism warrant urgent remediation. The same missing default-role override affects four additional companion endpoints per the advisory, widening the privilege-abuse surface.

How does the attack unfold?

Initial Access

Attacker obtains workspace membership via a legitimate invite, open-registration endpoint, or by compromising any existing member's credentials.

AML.T0012

Reconnaissance

Attacker extracts the target workspace_id from authenticated API responses, URL patterns in the web UI, or other member-accessible API endpoints.

AML.T0006

Exploitation

Attacker issues DELETE /workspaces/{workspace_id} with their member JWT; the missing owner-role check passes, and WorkspaceService.delete() executes the cascading database deletion.

AML.T0049

Impact

All workspace resources — agents, projects, issues, comments, labels, members, and the activity log — are permanently deleted with no recovery path, causing complete operational loss for the targeted tenant.

AML.T0048.003

Initial Access

Attacker obtains workspace membership via a legitimate invite, open-registration endpoint, or by compromising any existing member's credentials.

AML.T0012

Reconnaissance

Attacker extracts the target workspace_id from authenticated API responses, URL patterns in the web UI, or other member-accessible API endpoints.

AML.T0006

Exploitation

Attacker issues DELETE /workspaces/{workspace_id} with their member JWT; the missing owner-role check passes, and WorkspaceService.delete() executes the cascading database deletion.

AML.T0049

Impact

All workspace resources — agents, projects, issues, comments, labels, members, and the activity log — are permanently deleted with no recovery path, causing complete operational loss for the targeted tenant.

AML.T0048.003

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 68% patched ~14d to patch Full package profile →
PraisonAI	pip	< 0.1.4	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

6 steps

Patch immediately: upgrade praisonai-platform to 0.1.4, which restricts DELETE /workspaces/{workspace_id} to owner-role only.
If patching is blocked: add a WAF or API gateway rule to deny DELETE requests to /workspaces/* for tokens without owner-level claims.
Audit all workspace memberships and revoke unexpected or untrusted members.
Implement workspace data backups as a compensating control — the vulnerability has no soft-delete or recovery mechanism.
Enable API access logging on /workspaces/* DELETE methods and alert on any invocations pending patching.
Review companion endpoints (update_workspace, add_member, update_member_role, remove_member) flagged in the advisory as sharing the same default-min-role gap and apply the same owner-role tightening.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Framework AML.T0012 - Valid Accounts AML.T0048.003 - User Harm AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.1.2 - Information security roles and responsibilities

NIST AI RMF

GOVERN 1.2 - Policies, processes, procedures and practices across the organization

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47412?

PraisonAI Platform's workspace deletion endpoint lacks any owner-role gate, allowing any workspace member — regardless of privilege level — to issue a single HTTP DELETE and irreversibly destroy the entire workspace including all projects, agents, issues, comments, and member records via cascading database deletion. The blast radius is total: no soft-delete, no confirmation prompt, no audit trail (the activity log is also cascade-deleted), and no recovery path exists. With a CVSS of 8.1, low-complexity exploitation, and only a standard member token required, any invited collaborator or compromised account can execute this in seconds with no technical expertise. Organizations running praisonai-platform in multi-tenant or collaborative AI agent environments should patch to version 0.1.4 immediately; if patching is blocked, restrict workspace membership to fully trusted users and add an API gateway rule blocking DELETE on /workspaces/* endpoints for non-owner tokens.

Is CVE-2026-47412 actively exploited?

No confirmed active exploitation of CVE-2026-47412 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47412?

1. Patch immediately: upgrade praisonai-platform to 0.1.4, which restricts DELETE /workspaces/{workspace_id} to owner-role only. 2. If patching is blocked: add a WAF or API gateway rule to deny DELETE requests to /workspaces/* for tokens without owner-level claims. 3. Audit all workspace memberships and revoke unexpected or untrusted members. 4. Implement workspace data backups as a compensating control — the vulnerability has no soft-delete or recovery mechanism. 5. Enable API access logging on /workspaces/* DELETE methods and alert on any invocations pending patching. 6. Review companion endpoints (update_workspace, add_member, update_member_role, remove_member) flagged in the advisory as sharing the same default-min-role gap and apply the same owner-role tightening.

What systems are affected by CVE-2026-47412?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, collaborative AI agent workflows, AI orchestration platforms.

What is the CVSS score for CVE-2026-47412?

CVE-2026-47412 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI platformscollaborative AI agent workflowsAI orchestration platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0048.003 User Harm

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.1.2

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member of the workspace can issue a single DELETE to wipe the entire workspace, including every project, issue, comment, agent, label, and member record (cascading via the foreign-key relationships). There is no owner-role gate, no confirmation token, no soft-delete window, no recovery path. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

An adversary joins a target PraisonAI workspace via a legitimate invite link, a misconfigured open-registration endpoint, or by compromising any existing member's credentials. With a valid member JWT in hand, they issue a single HTTP DELETE to /workspaces/{workspace_id}. The FastAPI dependency require_workspace_member passes because the attacker holds a valid membership token and the default min_role='member' is satisfied without override. WorkspaceService.delete() executes immediately, triggering a cascading foreign-key deletion that wipes every project, agent, issue, comment, label, and member record in the workspace. The operation completes in milliseconds, is immediately irreversible, and produces no surviving audit trail. At scale, an attacker who enumerates accessible workspace IDs via other member-accessible API endpoints can script mass deletion across every workspace they have any membership in — a multi-tenant griefing scenario affecting all platform customers simultaneously.

Weaknesses (CWE)

CWE-269 Improper Privilege Management Primary CWE-269 Improper Privilege Management Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-269 Improper Privilege Management CWE-862 Missing Authorization

CWE-269 — Improper Privilege Management: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system.

Source: MITRE CWE corpus.