External risk intelligence

PraisonAI Platform Cross-Tenant Access and Privilege Escalation Vulnerabilities

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-47407

The platform is a web-based service that defaults to binding on 0.0.0.0:8000, making it directly accessible on the network. It features public-facing registration endpoints and operates as a platform for multi-agent teams, which is designed for web-based access in standard deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the PraisonAI Platform, affecting its ability to properly control access to workspace resources and member roles. This flaw could allow unauthorized users to view, modify, or delete data belonging to other workspaces, and also to elevate their own privileges within the system. The main concern at this stage is to confirm if our organization utilizes this specific platform and, if so, to understand the extent of potential exposure.

Unauthorized access to shared data.
Potential for privilege escalation by users.
Confirm relevance and exposure to PraisonAI Platform.

Attack Path

How an attacker could exploit the issue

An attacker can start with no authentication and register an account, then craft a request to access resources belonging to other users. This is possible because the system checks membership only for the workspace ID in the URL's prefix, not for the actual resource IDs requested. Attackers can then manipulate these resources, including potentially taking over entire workspaces.

Unauthenticated access to registration.
Insecure API calls to access resources.
Unauthorized access and modification of data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized users to access and manipulate data across different workspaces within the PraisonAI Platform. An attacker can exploit this by providing their own workspace ID in the URL while referencing resource IDs from other workspaces. Additionally, flaws in member management routes enable basic users to escalate privileges, modify roles, and even delete workspaces. Registration without email verification further simplifies unauthorized access.

Cross-tenant workspace data.
Accessing other users' resources.
Unauthorized data modification or deletion.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application and platform owners are responsible for securing the PraisonAI Platform. The first step is to locate all instances of the platform, confirm their exposure and business criticality, and identify the accountable owner. Remediation planning should then align with the identified risk level.

Identify platform instances and owners.
Verify platform reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the PraisonAI Platform?

PraisonAI Platform is the central server component that orchestrates multi-agent teams. It provides an API-driven interface for users to organize workflows and manage shared resources, such as projects and agents, across different workspaces. Developers and teams use this software to host and manage collaborative AI-driven automations.

What does CVE-2026-47407 mean?

This CVE represents a pair of authorization failures. The first, an Improper Authorization (CWE-863), allows users to access resources in workspaces they do not belong to by manipulating the URL. The second, a Privilege Escalation (CWE-269), allows standard members to perform administrative actions like deleting workspaces because the system fails to enforce role-based access controls for membership management commands.

How does an attacker trigger these bugs?

An attacker needs no special access to start; they can create an account via the open registration endpoint. To trigger the cross-tenant issue, they provide a workspace ID they own in a URL prefix while requesting resource IDs belonging to a victim. Simply logging in as a member is sufficient to trigger the privilege escalation, as the software does not check if a user is authorized to change roles or delete the workspace.

Is my PraisonAI instance at risk?

According to Halo Surface Signal, this software is often deployed with a default network bind of 0.0.0.0, which makes it directly reachable on the network. If your instance is hosted in an environment where it accepts connections from untrusted networks or the public internet, it is highly reachable and should be considered at risk.

How should I respond to this vulnerability?

The primary response is to update your software to version 0.1.4 or later, which contains the fixes for these authorization flaws. Before updating, identify all running instances within your environment, confirm who owns them, and evaluate their network reachability to prioritize which systems need immediate attention.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.