CVE-2026-47419: PraisonAI IDOR enables

CISO Take

PraisonAI Platform before 0.1.4 has a broken object-level authorization flaw where any authenticated workspace member can read, modify, or delete AI agents belonging to entirely different tenants by substituting a foreign agent UUID in the API path — no elevated privileges or special tooling required. The exposed data includes proprietary system prompt instructions and `runtime_config` fields that frequently carry LLM provider API keys in bring-your-own-key deployments, making this a direct credential exfiltration vector that also enables silent agent backdooring by redirecting all LLM traffic to an attacker-controlled endpoint. The same PraisonAI repository carries 66 other CVEs, signalling systemic authorization hygiene problems across the codebase, and exploitation complexity is trivial given that agent UUIDs leak through activity feeds, webhook payloads, and error messages. Patch to 0.1.4 immediately, rotate any API keys stored in agent runtime configurations, and audit access logs for cross-workspace UUID patterns.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk in any multi-tenant PraisonAI Platform deployment. Exploitation requires only a valid workspace membership token and one harvested agent UUID — both easily obtainable. CVSS 8.1 reflects network-accessible attack vector, low complexity, low privileges required, and high confidentiality and integrity impact. The absence of a workspace predicate in the DB query means the membership check is purely cosmetic, providing no actual tenant isolation. BYOK deployments elevate the effective impact further by exposing LLM provider API keys. No CISA KEV listing or public exploit code observed at time of analysis, but the exploit chain is fully deterministic and requires no AI/ML expertise.

How does the attack unfold?

Initial Access

Attacker registers as a legitimate user on the target PraisonAI Platform deployment, obtaining a valid JWT workspace membership token with no special privileges required.

AML.T0012

UUID Harvesting

Attacker collects target workspace agent UUIDs via activity feed log entries, webhook payloads, error messages, or issue body references that expose agent IDs as side channels.

AML.T0084

IDOR Exploitation

Attacker issues GET/PATCH/DELETE requests using their own workspace_id but a foreign agent_id; the membership check passes while the DB query returns the target workspace's full agent record with no workspace filter.

AML.T0049

Impact: Exfiltration & Backdoor

Attacker reads proprietary system prompt instructions and LLM API keys, overwrites agent instructions with a malicious prompt and redirects runtime_config to an attacker-controlled LLM proxy, or deletes the target workspace's agent fleet entirely.

AML.T0081

Initial Access

Attacker registers as a legitimate user on the target PraisonAI Platform deployment, obtaining a valid JWT workspace membership token with no special privileges required.

AML.T0012

UUID Harvesting

Attacker collects target workspace agent UUIDs via activity feed log entries, webhook payloads, error messages, or issue body references that expose agent IDs as side channels.

AML.T0084

IDOR Exploitation

Attacker issues GET/PATCH/DELETE requests using their own workspace_id but a foreign agent_id; the membership check passes while the DB query returns the target workspace's full agent record with no workspace filter.

AML.T0049

Impact: Exfiltration & Backdoor

Attacker reads proprietary system prompt instructions and LLM API keys, overwrites agent instructions with a malicious prompt and redirects runtime_config to an attacker-controlled LLM proxy, or deletes the target workspace's agent fleet entirely.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 68% patched ~14d to patch Full package profile →
PraisonAI	pip	< 0.1.4	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →
PraisonAI Agents	pip	—	No patch
11 dependents 65% patched ~6d to patch Full package profile →

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A Low

What should I do?

6 steps

Patch to praisonai-platform >= 0.1.4 immediately. The fix threads workspace_id into the AgentService.get/update/delete methods so the DB query includes an AND workspace_id = :workspace_id predicate, treating foreign-workspace agents as 404.
If patching is not immediately possible, disable multi-workspace deployments or place the agent CRUD API behind a network control that limits access to trusted tenants.
Rotate all LLM API keys stored in agent runtime_config fields as a precaution — assume any key in any workspace could have been read.
Review application access logs for API calls where workspace_id in the path does not match the workspace_id of the returned agent.
Audit IssueService, ProjectService, CommentService, and LabelService for the same missing workspace predicate pattern; treat those as unpatched until separately confirmed fixed.
Enable alerting on anomalous cross-tenant UUID access patterns going forward.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Data Leakage Agent API AML.T0048.004 - AI Intellectual Property Theft AML.T0049 - Exploit Public-Facing Application AML.T0081 - Modify AI Agent Configuration AML.T0083 - Credentials from AI Agent Configuration AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2 - Access control to AI systems

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI risk management

OWASP LLM Top 10

LLM07:2025 - System Prompt Leakage

Frequently Asked Questions

What is CVE-2026-47419?

PraisonAI Platform before 0.1.4 has a broken object-level authorization flaw where any authenticated workspace member can read, modify, or delete AI agents belonging to entirely different tenants by substituting a foreign agent UUID in the API path — no elevated privileges or special tooling required. The exposed data includes proprietary system prompt instructions and `runtime_config` fields that frequently carry LLM provider API keys in bring-your-own-key deployments, making this a direct credential exfiltration vector that also enables silent agent backdooring by redirecting all LLM traffic to an attacker-controlled endpoint. The same PraisonAI repository carries 66 other CVEs, signalling systemic authorization hygiene problems across the codebase, and exploitation complexity is trivial given that agent UUIDs leak through activity feeds, webhook payloads, and error messages. Patch to 0.1.4 immediately, rotate any API keys stored in agent runtime configurations, and audit access logs for cross-workspace UUID patterns.

Is CVE-2026-47419 actively exploited?

No confirmed active exploitation of CVE-2026-47419 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47419?

1. Patch to praisonai-platform >= 0.1.4 immediately. The fix threads `workspace_id` into the `AgentService.get/update/delete` methods so the DB query includes an `AND workspace_id = :workspace_id` predicate, treating foreign-workspace agents as 404. 2. If patching is not immediately possible, disable multi-workspace deployments or place the agent CRUD API behind a network control that limits access to trusted tenants. 3. Rotate all LLM API keys stored in agent `runtime_config` fields as a precaution — assume any key in any workspace could have been read. 4. Review application access logs for API calls where `workspace_id` in the path does not match the `workspace_id` of the returned agent. 5. Audit IssueService, ProjectService, CommentService, and LabelService for the same missing workspace predicate pattern; treat those as unpatched until separately confirmed fixed. 6. Enable alerting on anomalous cross-tenant UUID access patterns going forward.

What systems are affected by CVE-2026-47419?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, LLM API integrations, BYOK LLM deployments.

What is the CVSS score for CVE-2026-47419?

CVE-2026-47419 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI platformsLLM API integrationsBYOK LLM deployments

MITRE ATLAS Techniques

AML.T0048.004 AI Intellectual Property Theft

AML.T0049 Exploit Public-Facing Application

AML.T0081 Modify AI Agent Configuration

AML.T0083 Credentials from AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM07:2025

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}`) gate access on `require_workspace_member(workspace_id)` only, then resolve `agent_id` through `AgentService.get(agent_id)` which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace `W1` can read, modify, or delete agents that belong to a different workspace `W2` by guessing or harvesting an agent UUID and calling `…/workspaces/W1/agents/<W2-agent-id>`. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

An attacker registering as a trial user on a shared PraisonAI Platform SaaS deployment creates their own workspace and receives a valid JWT. They then harvest agent UUIDs belonging to a target tenant's workspace by monitoring the platform's activity feed (which logs `entity_id=agent.id` entries visible to any authenticated user), intercepting webhook payloads, or reading error messages that echo the UUID. Armed with a target UUID `A_T`, the attacker issues `GET /workspaces/<attacker_workspace>/agents/A_T` — the membership check passes because they are a member of their own workspace, and `AgentService.get(A_T)` executes `SELECT * FROM agents WHERE id = 'A_T'` with no workspace filter, returning the full agent record including proprietary system prompt and API keys. The attacker follows with a `PATCH` overwriting `instructions` with a prompt injection payload and `runtime_config.api_base` pointing to their own logging proxy, silently backdooring every future LLM interaction in the victim's workspace without any visible error or alert.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.