CVE-2026-47418: PraisonAI IDOR exposes

Q: Is CVE-2026-47418 actively exploited?

No confirmed active exploitation of CVE-2026-47418 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47418?

1. Patch immediately: upgrade praisonai-platform to 0.1.4, which scopes all project lookups to the authenticated workspace using a composite (workspace_id, project_id) WHERE predicate. 2. If patching is blocked, restrict /workspaces/*/projects/* API routes to trusted internal IP ranges at the reverse proxy or WAF layer. 3. Audit API access logs for requests where the workspace_id in the URL path does not correspond to the project's actual workspace — these anomalies indicate active exploitation. 4. Review activity and audit logs for unexpected project reads, modifications, or deletions across workspace boundaries. 5. If compromise is suspected, notify affected tenant workspace owners and assess whether project UUIDs need rotation. 6. Apply the same workspace-scoped lookup fix to AgentService, IssueService, CommentService, and LabelService, which the advisory explicitly identifies as carrying the identical structural gap.

Q: What systems are affected by CVE-2026-47418?

This vulnerability affects the following AI/ML architecture patterns: AI agent platforms, multi-tenant SaaS deployments, agent orchestration frameworks, agentic workflow management systems.

Q: What is the CVSS score for CVE-2026-47418?

CVE-2026-47418 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.29%.

CISO Take

PraisonAI Platform's multi-tenant project API contains an Insecure Direct Object Reference flaw where all four project endpoints — read, update, delete, and stats — gate access on workspace membership alone but perform resource lookups using only the project UUID, with no workspace-scoping predicate. Any authenticated tenant can read confidential AI agent project configurations, silently overwrite or archive projects, and permanently delete resources belonging to other workspaces by substituting a known project UUID into the URL path. With CVSS 8.1 (High) and no privileges beyond a basic workspace token required, exploitation is trivial — project UUIDs leak routinely via activity feeds, webhook payloads, and issue exports, so enumeration is accessible to any tenant on a shared deployment. Upgrade to praisonai-platform 0.1.4 immediately; if patching is blocked, restrict API routes at the network perimeter and audit logs for cross-workspace project UUID access patterns.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk in any multi-tenant PraisonAI deployment. Exploitation requires only a valid workspace membership token and a known target project UUID — both low barriers in a shared environment where UUIDs routinely surface in application data. No public exploit code or scanner template exists yet, but the exploit chain is fully described in the advisory and reproducible in minutes. The CVSS 8.1 reflects network-accessible, low-complexity exploitation with high confidentiality and integrity impact across all tenants. AI agent projects typically contain operationally sensitive context — roadmaps, agent configurations, lead assignments — amplifying business impact well beyond a standard IDOR. The parallel gap identified in AgentService, IssueService, CommentService, and LabelService suggests a systemic authorization design defect rather than a one-off oversight.

How does the attack unfold?

Initial Access

Attacker registers a legitimate account and creates or joins any workspace on the target multi-tenant PraisonAI deployment, obtaining a valid authentication token.

AML.T0012

Reconnaissance

Attacker harvests target project UUIDs from their own activity feed logs, webhook payloads, issue export files, or error messages that expose cross-workspace project_id values through normal platform operation.

AML.T0036

Exploitation

Attacker issues authenticated API calls using their own workspace_id combined with victim project UUIDs, bypassing the workspace membership gate to read, modify, or delete foreign project resources.

AML.T0049

Impact

Attacker exfiltrates confidential AI agent project configurations, corrupts or archives victim projects via PATCH, permanently destroys projects via DELETE, and maps the deployment's full workspace topology from leaked workspace_id fields in API responses.

AML.T0025

Initial Access

Attacker registers a legitimate account and creates or joins any workspace on the target multi-tenant PraisonAI deployment, obtaining a valid authentication token.

AML.T0012

Reconnaissance

Attacker harvests target project UUIDs from their own activity feed logs, webhook payloads, issue export files, or error messages that expose cross-workspace project_id values through normal platform operation.

AML.T0036

Exploitation

Attacker issues authenticated API calls using their own workspace_id combined with victim project UUIDs, bypassing the workspace membership gate to read, modify, or delete foreign project resources.

AML.T0049

Impact

Attacker exfiltrates confidential AI agent project configurations, corrupts or archives victim projects via PATCH, permanently destroys projects via DELETE, and maps the deployment's full workspace topology from leaked workspace_id fields in API responses.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	< 0.1.4	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

6 steps

Patch immediately: upgrade praisonai-platform to 0.1.4, which scopes all project lookups to the authenticated workspace using a composite (workspace_id, project_id) WHERE predicate.
If patching is blocked, restrict /workspaces/*/projects/* API routes to trusted internal IP ranges at the reverse proxy or WAF layer.
Audit API access logs for requests where the workspace_id in the URL path does not correspond to the project's actual workspace — these anomalies indicate active exploitation.
Review activity and audit logs for unexpected project reads, modifications, or deletions across workspace boundaries.
If compromise is suspected, notify affected tenant workspace owners and assess whether project UUIDs need rotation.
Apply the same workspace-scoped lookup fix to AgentService, IssueService, CommentService, and LabelService, which the advisory explicitly identifies as carrying the identical structural gap.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Framework AML.T0007 - Discover AI Artifacts AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0036 - Data from Information Repositories AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.6.2.3 - AI system access control

NIST AI RMF

GOVERN 1.2 - Accountability and access control for AI systems

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-47418?

PraisonAI Platform's multi-tenant project API contains an Insecure Direct Object Reference flaw where all four project endpoints — read, update, delete, and stats — gate access on workspace membership alone but perform resource lookups using only the project UUID, with no workspace-scoping predicate. Any authenticated tenant can read confidential AI agent project configurations, silently overwrite or archive projects, and permanently delete resources belonging to other workspaces by substituting a known project UUID into the URL path. With CVSS 8.1 (High) and no privileges beyond a basic workspace token required, exploitation is trivial — project UUIDs leak routinely via activity feeds, webhook payloads, and issue exports, so enumeration is accessible to any tenant on a shared deployment. Upgrade to praisonai-platform 0.1.4 immediately; if patching is blocked, restrict API routes at the network perimeter and audit logs for cross-workspace project UUID access patterns.

Is CVE-2026-47418 actively exploited?

No confirmed active exploitation of CVE-2026-47418 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47418?

1. Patch immediately: upgrade praisonai-platform to 0.1.4, which scopes all project lookups to the authenticated workspace using a composite (workspace_id, project_id) WHERE predicate. 2. If patching is blocked, restrict /workspaces/*/projects/* API routes to trusted internal IP ranges at the reverse proxy or WAF layer. 3. Audit API access logs for requests where the workspace_id in the URL path does not correspond to the project's actual workspace — these anomalies indicate active exploitation. 4. Review activity and audit logs for unexpected project reads, modifications, or deletions across workspace boundaries. 5. If compromise is suspected, notify affected tenant workspace owners and assess whether project UUIDs need rotation. 6. Apply the same workspace-scoped lookup fix to AgentService, IssueService, CommentService, and LabelService, which the advisory explicitly identifies as carrying the identical structural gap.

What systems are affected by CVE-2026-47418?

This vulnerability affects the following AI/ML architecture patterns: AI agent platforms, multi-tenant SaaS deployments, agent orchestration frameworks, agentic workflow management systems.

What is the CVSS score for CVE-2026-47418?

CVE-2026-47418 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

AI agent platformsmulti-tenant SaaS deploymentsagent orchestration frameworksagentic workflow management systems

MITRE ATLAS Techniques

AML.T0007 Discover AI Artifacts

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0036 Data from Information Repositories

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.6.2.3

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/projects/{project_id}` and `GET .../{project_id}/stats`) gate access on `require_workspace_member(workspace_id)` only, then resolve `project_id` through `ProjectService.get(project_id)` / `update(project_id, ...)` / `delete(project_id)` / `get_stats(project_id)`. None of these calls thread `workspace_id` through to constrain the lookup. A user who is a member of any workspace `W1` can read, modify, delete, or read stats for projects that belong to a different workspace `W2`. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

An attacker operating a competing organization signs up for a free account on a shared PraisonAI SaaS deployment and joins or creates their own workspace. Over several days they passively collect project UUIDs from their own activity feed, webhook notifications, and issue export files — these routinely expose project_id values from server-side cross-workspace logs. The attacker then issues authenticated GET requests substituting harvested project UUIDs against their own workspace_id path segment, reading confidential AI agent project configurations and roadmap descriptions belonging to enterprise customers. They follow up with PATCH requests to silently corrupt high-value competitor projects by overwriting titles and descriptions, then DELETE requests to permanently destroy them before the incident is detected — all while the authorization layer reports success because the attacker holds a valid workspace membership token.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.