CVE-2026-47414: PraisonAI IDOR cross-workspace label

Q: Is CVE-2026-47414 actively exploited?

No confirmed active exploitation of CVE-2026-47414 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47414?

1. Patch immediately: upgrade praisonai-platform to 0.1.4, which adds workspace_id predicates to every single-row label lookup and association write. 2. If patching is blocked, restrict label API endpoints at the API gateway or WAF layer—validate that label_id and issue_id exist within the authenticated workspace before forwarding requests to the service layer. 3. Audit the four explicitly named companion services in the same codebase: AgentService, IssueService, ProjectService, and CommentService share the identical authorization gap per the advisory. 4. Review audit logs for cross-workspace anomalies: PATCH or DELETE requests on label endpoints where label_id is absent from the authenticated workspace's own label inventory. 5. For multi-tenant operators: notify affected tenants and restore labels from backup if tampering is suspected, as renames and deletes are silent and permanent in the unpatched version.

Q: What systems are affected by CVE-2026-47414?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, AI task orchestration, collaborative AI workflow systems.

Q: What is the CVSS score for CVE-2026-47414?

CVE-2026-47414 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.21%.

CISO Take

The praisonai-platform AI agent orchestration framework (≤ 0.1.2) exposes five label management API endpoints that accept attacker-supplied label_id and issue_id values without verifying workspace ownership, allowing any authenticated tenant to rename, delete, or reassign labels across all workspaces in a multi-tenant deployment. Exploitation requires only a valid membership token—obtainable by any free registrant—and knowledge of foreign IDs discoverable through sequential enumeration or normal API responses, placing this squarely in low-complexity, low-privilege territory with no user interaction needed. The integrity impact is acute for AI agent platforms where labels govern task routing and triage: a malicious tenant can silently corrupt a competitor's AI workflow taxonomy, mislabel security-sensitive agent tasks, or strip labels from critical issues—all without triggering victim-side notification. This is not an isolated flaw; 59 other CVEs exist in the same package and the advisory explicitly names four companion IDORs (AgentService, IssueService, ProjectService, CommentService), signaling a systemic authorization defect. Upgrade to praisonai-platform 0.1.4 immediately and audit all companion service classes before returning multi-tenant access.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

High risk for any multi-tenant praisonai-platform deployment. CVSS 7.6 with network attack vector, low complexity, and low privileges reflects a genuinely low barrier to exploitation—no AI/ML expertise required, only HTTP access and a free account. The 59 other CVEs in this package and four explicitly documented companion IDORs in the same advisory signal a systemic authorization defect pattern rather than an isolated bug, substantially elevating confidence that additional unexplored attack surfaces remain. Single-tenant self-hosted deployments face significantly reduced risk; shared SaaS or enterprise multi-workspace instances running ≤ 0.1.2 are directly exposed with no mitigating control in the default configuration.

How does the attack unfold?

Account Establishment

Attacker registers a workspace on the shared praisonai-platform instance to obtain a valid membership token that satisfies the require_workspace_member check.

AML.T0021

Foreign ID Enumeration

Attacker harvests foreign workspace label_id and issue_id values through sequential enumeration, API response inspection, or activity feed leakage from their own workspace context.

AML.T0006

Authorization Bypass

Attacker submits PATCH, DELETE, and POST label requests using their own workspace_id (passing membership check) but supplying foreign label_id and issue_id values, exploiting the absent service-layer workspace constraint.

AML.T0049

Workflow Integrity Compromise

Attacker renames and deletes victim workspace labels, corrupts issue-label associations disrupting AI agent task routing, and exfiltrates the victim's internal workflow classification taxonomy.

AML.T0048.001

Account Establishment

Attacker registers a workspace on the shared praisonai-platform instance to obtain a valid membership token that satisfies the require_workspace_member check.

AML.T0021

Foreign ID Enumeration

Attacker harvests foreign workspace label_id and issue_id values through sequential enumeration, API response inspection, or activity feed leakage from their own workspace context.

AML.T0006

Authorization Bypass

Attacker submits PATCH, DELETE, and POST label requests using their own workspace_id (passing membership check) but supplying foreign label_id and issue_id values, exploiting the absent service-layer workspace constraint.

AML.T0049

Workflow Integrity Compromise

Attacker renames and deletes victim workspace labels, corrupts issue-label associations disrupting AI agent task routing, and exfiltrates the victim's internal workflow classification taxonomy.

AML.T0048.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 0.1.2	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 12% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I High

A Low

What should I do?

5 steps

Patch immediately: upgrade praisonai-platform to 0.1.4, which adds workspace_id predicates to every single-row label lookup and association write.
If patching is blocked, restrict label API endpoints at the API gateway or WAF layer—validate that label_id and issue_id exist within the authenticated workspace before forwarding requests to the service layer.
Audit the four explicitly named companion services in the same codebase: AgentService, IssueService, ProjectService, and CommentService share the identical authorization gap per the advisory.
Review audit logs for cross-workspace anomalies: PATCH or DELETE requests on label endpoints where label_id is absent from the authenticated workspace's own label inventory.
For multi-tenant operators: notify affected tenants and restore labels from backup if tampering is suspected, as renames and deletes are silent and permanent in the unpatched version.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Privacy Violation Agent Framework AML.T0006 - Active Scanning AML.T0012 - Valid Accounts AML.T0021 - Establish Accounts AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.6.2 - Access Control

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI risk management

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47414?

The praisonai-platform AI agent orchestration framework (≤ 0.1.2) exposes five label management API endpoints that accept attacker-supplied label_id and issue_id values without verifying workspace ownership, allowing any authenticated tenant to rename, delete, or reassign labels across all workspaces in a multi-tenant deployment. Exploitation requires only a valid membership token—obtainable by any free registrant—and knowledge of foreign IDs discoverable through sequential enumeration or normal API responses, placing this squarely in low-complexity, low-privilege territory with no user interaction needed. The integrity impact is acute for AI agent platforms where labels govern task routing and triage: a malicious tenant can silently corrupt a competitor's AI workflow taxonomy, mislabel security-sensitive agent tasks, or strip labels from critical issues—all without triggering victim-side notification. This is not an isolated flaw; 59 other CVEs exist in the same package and the advisory explicitly names four companion IDORs (AgentService, IssueService, ProjectService, CommentService), signaling a systemic authorization defect. Upgrade to praisonai-platform 0.1.4 immediately and audit all companion service classes before returning multi-tenant access.

Is CVE-2026-47414 actively exploited?

No confirmed active exploitation of CVE-2026-47414 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47414?

1. Patch immediately: upgrade praisonai-platform to 0.1.4, which adds workspace_id predicates to every single-row label lookup and association write. 2. If patching is blocked, restrict label API endpoints at the API gateway or WAF layer—validate that label_id and issue_id exist within the authenticated workspace before forwarding requests to the service layer. 3. Audit the four explicitly named companion services in the same codebase: AgentService, IssueService, ProjectService, and CommentService share the identical authorization gap per the advisory. 4. Review audit logs for cross-workspace anomalies: PATCH or DELETE requests on label endpoints where label_id is absent from the authenticated workspace's own label inventory. 5. For multi-tenant operators: notify affected tenants and restore labels from backup if tampering is suspected, as renames and deletes are silent and permanent in the unpatched version.

What systems are affected by CVE-2026-47414?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, AI task orchestration, collaborative AI workflow systems.

What is the CVSS score for CVE-2026-47414?

CVE-2026-47414 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.21%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI platformsAI task orchestrationcollaborative AI workflow systems

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0012 Valid Accounts

AML.T0021 Establish Accounts

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — `PATCH /workspaces/{workspace_id}/labels/{label_id}`, `DELETE .../labels/{label_id}`, `POST .../issues/{issue_id}/labels/{label_id}`, `DELETE .../issues/{issue_id}/labels/{label_id}`, `GET .../issues/{issue_id}/labels` — gate access on `require_workspace_member(workspace_id)` only and pass URL-supplied `label_id` and `issue_id` straight through to `LabelService` without verifying either belongs to the workspace. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

A threat actor registers a free workspace on a shared praisonai-platform SaaS instance to obtain a valid membership token. Through normal API calls against their own workspace they harvest label_id values (included in list responses), then discover foreign issue_id values via sequential integer or UUID enumeration, API error message leakage, or shared activity feeds. Using their own workspace_id as the URL namespace—which passes the membership check—the attacker sends PATCH /workspaces/W_attacker/labels/{foreign_label_id} to rename a victim organization's AI agent task label (e.g., 'security-escalation') to a benign name, then sends DELETE to permanently remove it, cascade-deleting all associated issue-label rows in the victim workspace. Simultaneously, they invoke GET /workspaces/W_attacker/issues/{foreign_issue_id}/labels to enumerate the victim's full workflow taxonomy, gaining intelligence on how the target classifies and prioritizes AI agent operations—all from a single unprivileged membership token with no victim-side indication of compromise.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.