CVE-2026-47399: PraisonAI Auth Bypass Vulnerability

CVE-2026-47399 Overview

CVE-2026-47399 is a broken access control vulnerability [CWE-284] in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 contain a systemic object-level authorization flaw across workspace-scoped REST routes. Authenticated members of one workspace can read, modify, or delete objects belonging to another workspace by supplying the victim object's global UUID. The route layer validates workspace membership from the URL, but the service layer resolves target objects by global UUID without confirming they belong to that workspace. PraisonAI Platform 0.1.4 patches the issue.

Critical Impact
Any authenticated workspace member can breach the platform's workspace isolation boundary to access, mutate, or delete agents, projects, issues, and comments across tenants.

Affected Products

PraisonAI Platform versions prior to 0.1.4
Workspace-scoped REST routes including agents, projects, issues, and comments
Deployments exposing /api/v1/workspaces/{workspace_id}/... endpoints

Discovery Timeline

2026-07-21 - CVE-2026-47399 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-47399

Vulnerability Analysis

The flaw is a horizontal privilege escalation via insecure direct object reference across workspace-scoped REST endpoints. PraisonAI Platform's authorization pipeline is split between two layers that do not agree on the target object. The route layer calls require_workspace_member to confirm the caller belongs to the workspace_id in the URL path. The service layer then loads the target object by its global UUID, without verifying the object's parent workspace matches the URL. An attacker who is a valid member of workspace_attacker can supply any UUID from workspace_victim and have the server operate on it. This affects read, update, and delete operations across agents, projects, issues, and comments.

Root Cause

The root cause is missing tenant scoping in service-layer object resolution. Authorization is decided from URL path parameters, while data access uses globally unique identifiers that ignore that context. The removed helper ensure_resource_in_workspace indicates the codebase previously acknowledged the requirement but did not apply it consistently across routes.

Attack Vector

Exploitation requires only low-privileged authenticated access to any workspace on the target platform. The attacker enumerates or otherwise obtains a UUID of a target object in another workspace, then issues a standard REST call under their own workspace path referencing that UUID. No user interaction is needed, and the attack is network-reachable.

python

# Security patch excerpt from src/praisonai-platform/praisonai_platform/api/routes/agents.py
# Source: https://github.com/MervinPraison/PraisonAI/commit/24385d64876577620f749957bd4814f162f4ca47

from praisonaiagents.auth import AuthIdentity

-from ..deps import ensure_resource_in_workspace, get_db, require_workspace_member
+from ..deps import get_db, require_workspace_member
 from ..schemas import AgentCreate, AgentResponse, AgentUpdate
 from ...services.agent_service import AgentService

The patch also hardens the default bind host in __main__.py, moving from 0.0.0.0 to 127.0.0.1 (overridable via the PLATFORM_HOST environment variable) to reduce accidental network exposure.

Detection Methods for CVE-2026-47399

Indicators of Compromise

Requests to /api/v1/workspaces/{workspace_id}/... where the referenced object UUID does not belong to workspace_id in application logs.
Cross-workspace object mutations or deletions performed by users who have never authenticated to the affected tenant.
Sudden appearance, modification, or removal of agents, projects, issues, or comments without matching workspace audit trail entries.

Detection Strategies

Correlate the caller's workspace membership with the parent workspace of every accessed object in API access logs, alerting on mismatches.
Instrument the service layer with logging of resolved object workspace_id alongside the URL workspace_id to surface divergence.
Baseline UUID enumeration behavior and flag accounts issuing high volumes of requests with non-sequential foreign UUIDs.

Monitoring Recommendations

Ship PraisonAI Platform API logs to a centralized analytics store for retention and cross-tenant query.
Track write and delete verbs against agents, projects, issues, and comments routes and review any bursts.
Monitor authentication events and API keys for tokens that touch multiple workspaces in short windows.

How to Mitigate CVE-2026-47399

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later without delay.
Rotate API tokens and session credentials issued by earlier versions in case of prior enumeration.
Audit agents, projects, issues, and comments for unauthorized changes made before the upgrade.

Patch Information

The fix is delivered in PraisonAI Platform 0.1.4 via GitHub Pull Request #1686 and commit 24385d6. Details are published in the GitHub Security Advisory GHSA-6h6v-6m7w-7vxx. The patch removes the flawed resource lookup dependency and requires the service layer to validate that resolved objects belong to the URL-provided workspace.

Workarounds

Restrict network exposure by binding the platform to 127.0.0.1 or an internal interface using the new PLATFORM_HOST environment variable.
Place the platform behind an authenticating reverse proxy that enforces additional workspace context checks.
Limit workspace membership to trusted users until the upgrade is applied.

bash

# Restrict the PraisonAI Platform listener to loopback and upgrade
export PLATFORM_HOST=127.0.0.1
pip install --upgrade "praisonai-platform>=0.1.4"
python -m praisonai_platform --host "$PLATFORM_HOST" --port 8000