CVE-2026-47419: PraisonAI Platform Auth Bypass Vulnerability

CVE-2026-47419 Overview

CVE-2026-47419 is an Insecure Direct Object Reference (IDOR) vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 fail to enforce workspace ownership when resolving agent identifiers in CRUD endpoints. A user who belongs to any workspace can read, modify, or delete agents that reside in a different workspace by supplying the target agent's UUID. The flaw is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key] and carries a CVSS 3.1 score of 8.3. PraisonAI Platform 0.1.4 remediates the issue.

Critical Impact
Any authenticated workspace member can access, alter, or delete agents in unrelated workspaces, breaking multi-tenant isolation across the PraisonAI Platform.

Affected Products

PraisonAI Platform versions prior to 0.1.4
Agent CRUD endpoints GET /workspaces/{workspace_id}/agents/{agent_id}, PATCH /workspaces/{workspace_id}/agents/{agent_id}, and DELETE /workspaces/{workspace_id}/agents/{agent_id}
Multi-tenant deployments relying on workspace-scoped agent isolation

Discovery Timeline

2026-07-21 - CVE-2026-47419 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-47419

Vulnerability Analysis

The vulnerability resides in the agent CRUD endpoints exposed under /workspaces/{workspace_id}/agents/{agent_id}. The endpoints call require_workspace_member(workspace_id) to confirm the caller is a member of the workspace specified in the URL path. Authorization stops there. The handler then invokes AgentService.get(agent_id), which performs a primary-key lookup against the agents table without joining or filtering by workspace_id.

Because the returned agent is never compared to the workspace supplied in the request, the caller receives, modifies, or deletes any agent whose UUID is known or guessed. Attackers with membership in a low-privilege workspace can pivot across the entire tenant boundary. The impact spans confidentiality (agent configuration disclosure), integrity (agent modification), and availability (agent deletion).

Root Cause

The root cause is a missing tenancy check between the path parameter workspace_id and the resource returned by AgentService.get(agent_id). Access control depends solely on membership of the workspace named in the URL rather than on the workspace that actually owns the target agent. This pattern is a canonical [CWE-639] Insecure Direct Object Reference.

Attack Vector

Exploitation requires only a valid authenticated session in any workspace on the platform. The attacker calls GET /workspaces/W1/agents/<W2-agent-id> where W1 is a workspace they legitimately belong to and <W2-agent-id> is a UUID belonging to a foreign workspace W2. Agent UUIDs may be harvested from logs, shared links, integrations, or brute-forced where identifiers are sequential or predictable.

The same substitution works against PATCH for modification and DELETE for destruction. No user interaction on the victim side is required. See the GitHub Security Advisory GHSA-7p8g-6c6g-h9w7 and the GitHub Commit Overview for the corresponding code changes.

Detection Methods for CVE-2026-47419

Indicators of Compromise

Access log entries where the agent_id in the URL path resolves to a workspace different from the workspace_id in the same path
PATCH or DELETE requests against /workspaces/{workspace_id}/agents/{agent_id} originating from users who have never previously interacted with that agent
Bursts of GET requests to agent endpoints iterating through many distinct UUIDs from a single account
Unexpected agent deletions or configuration changes reported by workspace owners

Detection Strategies

Correlate the workspace_id path parameter with the owning workspace of the returned agent_id in application logs and alert on mismatches
Baseline per-user agent access patterns and flag accounts that suddenly reference agent UUIDs outside their historical workspace scope
Instrument AgentService.get() to emit an audit event capturing caller identity, requested workspace, and actual owning workspace

Monitoring Recommendations

Ingest PraisonAI Platform application and audit logs into a centralized analytics pipeline for cross-workspace correlation
Monitor administrative actions on agents (create, update, delete) and route them to security review
Track HTTP 200 responses on agent endpoints where request and resource workspace differ post-patch, indicating configuration drift

How to Mitigate CVE-2026-47419

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later without delay
Review audit logs for prior cross-workspace agent access and rotate any secrets or credentials referenced by exposed agents
Notify affected workspace owners if evidence of unauthorized modification or deletion is found
Enforce least-privilege workspace membership and remove inactive accounts

Patch Information

PraisonAI Platform 0.1.4 fixes the flaw by binding agent lookups to the workspace supplied in the request path. The remediation is described in the GitHub Security Advisory GHSA-7p8g-6c6g-h9w7 and applied in the upstream commit ef79b7a. Administrators operating self-hosted deployments should validate the running version with pip show praisonai and redeploy affected containers.

Workarounds

If upgrading immediately is not feasible, place a reverse proxy or API gateway rule that rejects agent CRUD requests where the caller is not the workspace owner of the target agent
Restrict platform access to trusted users while a fix is deployed and disable public or self-service workspace creation
Rotate agent UUIDs after patching if leakage is suspected, since guessing risk depends on identifier exposure

bash

# Verify the installed PraisonAI Platform version and upgrade to the patched release
pip show praisonai | grep -i version
pip install --upgrade "praisonai>=0.1.4"

# Restart the platform service after upgrade
systemctl restart praisonai-platform