AI Threat AlertCVE-2026-57121: PraisonAI: missing ownership check lets members delete data
HIGHPraisonAI's praisonai-platform (0.1.4 up to 0.1.5) has a broken authorization flaw (CWE-285): all six content DELETE endpoints check only that the caller is a workspace member, not that they own the resource or hold an appropriate role. Any low-privileged or compromised member account can therefore permanently delete projects, agents, issues, labels, dependencies and label attachments created by the owner or other members. The CVSS is 8.1 (high), driven by network reachability, low complexity and irreversible integrity and availability impact. There is no KEV listing, no public exploit and no EPSS data yet, but exploitation is trivial for anyone with a member account, so the practical risk is insider abuse or credential takeover. Upgrade to praisonai-platform 0.1.5, confirm backups of workspace data exist, and review DELETE activity in logs for unexpected removals.
What is the risk?
High severity (CVSS 8.1) but not currently known to be exploited: not in CISA KEV, no public exploit, no Nuclei template, EPSS unavailable. Exploitation needs only a valid workspace member account (PR:L) and a single authenticated API call with no user interaction, so complexity is very low. Confidentiality is not affected. The risk is concentrated in multi-user workspaces where members have differing trust levels, and in cases where member credentials are phished, leaked or shared. Impact is irreversible data loss, so recovery depends entirely on backups.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| PraisonAI | pip | — | No patch |
Do you use PraisonAI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade praisonai-platform to 0.1.5 or later. 2) Until patched, limit workspace membership to fully trusted users, remove stale accounts and rotate credentials for members. 3) Restrict network access to the platform API (VPN, IP allowlists, reverse-proxy rules blocking DELETE for non-admins). 4) Take regular, tested backups of the platform database so workspace content can be restored. 5) Monitor and alert on DELETE requests to the project, agent, issue, label, dependency and label-attachment endpoints, especially bursts from one member account. 6) Enforce MFA or SSO on accounts that can reach the platform where supported.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-57121?
PraisonAI's praisonai-platform (0.1.4 up to 0.1.5) has a broken authorization flaw (CWE-285): all six content DELETE endpoints check only that the caller is a workspace member, not that they own the resource or hold an appropriate role. Any low-privileged or compromised member account can therefore permanently delete projects, agents, issues, labels, dependencies and label attachments created by the owner or other members. The CVSS is 8.1 (high), driven by network reachability, low complexity and irreversible integrity and availability impact. There is no KEV listing, no public exploit and no EPSS data yet, but exploitation is trivial for anyone with a member account, so the practical risk is insider abuse or credential takeover. Upgrade to praisonai-platform 0.1.5, confirm backups of workspace data exist, and review DELETE activity in logs for unexpected removals.
Is CVE-2026-57121 actively exploited?
No confirmed active exploitation of CVE-2026-57121 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-57121?
1) Upgrade praisonai-platform to 0.1.5 or later. 2) Until patched, limit workspace membership to fully trusted users, remove stale accounts and rotate credentials for members. 3) Restrict network access to the platform API (VPN, IP allowlists, reverse-proxy rules blocking DELETE for non-admins). 4) Take regular, tested backups of the platform database so workspace content can be restored. 5) Monitor and alert on DELETE requests to the project, agent, issue, label, dependency and label-attachment endpoints, especially bursts from one member account. 6) Enforce MFA or SSO on accounts that can reach the platform where supported.
What systems are affected by CVE-2026-57121?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration platforms, collaborative AI workspaces.
What is the CVSS score for CVE-2026-57121?
CVE-2026-57121 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.33%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0049Exploit Public-Facing ApplicationAML.T0101Data Destruction via AI Agent Tool InvocationCompliance Controls Affected
What are the technical details?
Original Advisory
PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.
Exploitation Scenario
An attacker phishes or buys the credentials of a low-privileged member in a team's PraisonAI workspace, or a disgruntled contractor already holds such an account. They authenticate to the platform API, enumerate the project, agent and issue IDs created by the workspace owner, and send DELETE requests to each endpoint. Because the server verifies only membership, every request succeeds. Within minutes the team's agent definitions, project tracking and issue history are gone, halting the agent-driven workflows and forcing a restore from backup, if one exists.
Weaknesses (CWE)
CWE-285 — Improper Authorization: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HTimeline
Related Vulnerabilities
CVE-2026-4816810.0PraisonAI: shell injection in Claude Action enables RCE
Same package: praisonaiCVE-2026-6144710.0PraisonAI: RCE via unsandboxed LLM code execution
Same package: praisonaiCVE-2026-614459.9PraisonAI: AICoder root RCE via unsanitized tool calls
Same package: praisonaiGHSA-vmmj-pfw7-fjwp9.9praisonai: sandbox escape gives RCE via codeMode tool
Same package: praisonaiCVE-2026-473929.9praisonaiagents: RCE via Python sandbox bypass
Same package: praisonai