CVE-2026-62179: PraisonAI authz flaw lets members

Q: Is CVE-2026-62179 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-62179, increasing the risk of exploitation.

Q: How to fix CVE-2026-62179?

1) Upgrade praisonai-platform to 0.1.9 or later. 2) Until patched, restrict workspace membership to trusted users and limit who can create or own related issues. 3) Audit logs and database records for dependency deletions made through member-owned issue endpoints, and compare current dependency graphs against backups or expected state. 4) Restrict network exposure of the platform API to internal networks or a VPN. 5) Inventory other PraisonAI components (praisonai, praisonaiagents) and track their advisories given the package's CVE history.

Q: What systems are affected by CVE-2026-62179?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration platforms, agent task/workflow management.

Q: What is the CVSS score for CVE-2026-62179?

CVE-2026-62179 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.18%.

CISO Take

PraisonAI's praisonai-platform (versions 0.1.8 and earlier) has a missing-authorization flaw in its issue dependency deletion route: it checks delete permission only against the issue in the caller-chosen URL rather than both ends of the dependency edge. A low-privileged workspace member can therefore delete a dependency they are blocked from deleting through the owner-created issue endpoint, by going through a member-owned related issue instead. Exploitation needs only a valid account, with no user interaction and low complexity, but the impact is limited to integrity of project-tracking data (CVSS 6.5, no confidentiality or availability impact). There is no KEV listing, no public exploit, no Nuclei template and no EPSS score, and only 1 downstream dependent, so the blast radius is small. Upgrade to praisonai-platform 0.1.9. Teams that cannot upgrade yet should review workspace membership and audit logs for unexpected dependency deletions. The package has 164 other CVEs, which points to weak security hygiene that deserves a broader review before it handles sensitive agent workflows.

Sources:NVDGitHub Advisory

What is the risk?

Medium. The attack is network-reachable, low complexity and needs only low privileges, but it yields integrity impact only (no data exposure, no downtime). There is no known exploitation, no public exploit and no KEV listing. Real-world exposure is limited to multi-user PraisonAI platform deployments where members have different permission levels. The high count of prior CVEs in the package (164) raises concern about the overall security posture.

How does the attack unfold?

Initial Access

Attacker holds or obtains a low-privileged workspace member account on the PraisonAI platform.

AML.T0012

Setup

Attacker creates or uses a member-owned issue that is related to the owner-created issue holding the target dependency.

Exploitation

Attacker calls the delete-dependency route via the member-owned issue URL, and the permission check only covers that URL issue.

AML.T0049

Impact

The protected dependency edge is deleted, which corrupts task ordering and gating logic for agent workflows.

Initial Access

Attacker holds or obtains a low-privileged workspace member account on the PraisonAI platform.

AML.T0012

Setup

Attacker creates or uses a member-owned issue that is related to the owner-created issue holding the target dependency.

Exploitation

Attacker calls the delete-dependency route via the member-owned issue URL, and the permission check only covers that URL issue.

AML.T0049

Impact

The protected dependency edge is deleted, which corrupts task ordering and gating logic for agent workflows.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents61% patched~23d to patchFull package profile →
PraisonAI	pip	<= 0.1.8	`0.1.9`
1 dependents61% patched~23d to patchFull package profile →

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

1) Upgrade praisonai-platform to 0.1.9 or later. 2) Until patched, restrict workspace membership to trusted users and limit who can create or own related issues. 3) Audit logs and database records for dependency deletions made through member-owned issue endpoints, and compare current dependency graphs against backups or expected state. 4) Restrict network exposure of the platform API to internal networks or a VPN. 5) Inventory other PraisonAI components (praisonai, praisonaiagents) and track their advisories given the package's CVE history.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassAgentFrameworkAPIAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and risk treatment

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-62179?

PraisonAI's praisonai-platform (versions 0.1.8 and earlier) has a missing-authorization flaw in its issue dependency deletion route: it checks delete permission only against the issue in the caller-chosen URL rather than both ends of the dependency edge. A low-privileged workspace member can therefore delete a dependency they are blocked from deleting through the owner-created issue endpoint, by going through a member-owned related issue instead. Exploitation needs only a valid account, with no user interaction and low complexity, but the impact is limited to integrity of project-tracking data (CVSS 6.5, no confidentiality or availability impact). There is no KEV listing, no public exploit, no Nuclei template and no EPSS score, and only 1 downstream dependent, so the blast radius is small. Upgrade to praisonai-platform 0.1.9. Teams that cannot upgrade yet should review workspace membership and audit logs for unexpected dependency deletions. The package has 164 other CVEs, which points to weak security hygiene that deserves a broader review before it handles sensitive agent workflows.

Is CVE-2026-62179 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-62179, increasing the risk of exploitation.

How to fix CVE-2026-62179?

1) Upgrade praisonai-platform to 0.1.9 or later. 2) Until patched, restrict workspace membership to trusted users and limit who can create or own related issues. 3) Audit logs and database records for dependency deletions made through member-owned issue endpoints, and compare current dependency graphs against backups or expected state. 4) Restrict network exposure of the platform API to internal networks or a VPN. 5) Inventory other PraisonAI components (praisonai, praisonaiagents) and track their advisories given the package's CVE history.

What systems are affected by CVE-2026-62179?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-agent orchestration platforms, agent task/workflow management.

What is the CVSS score for CVE-2026-62179?

CVE-2026-62179 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-agent orchestration platformsagent task/workflow management

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.

Exploitation Scenario

A malicious or compromised workspace member creates an issue they own and links it to an owner-created issue that has a dependency edge, for example a security-review gate that must complete before an agent deploys. The member cannot delete that edge through the owner's issue endpoint, so they call the delete-dependency route on their own related issue, which authorizes against the URL issue only. The dependency is removed, so the gating relationship disappears and downstream agent tasks can run without the required prerequisite.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing AuthorizationPrimary CWE-863Incorrect AuthorizationPrimary CWE-863Incorrect AuthorizationPrimary CWE-862Missing Authorization CWE-863Incorrect Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.