Loading story…
Multiple vulnerabilities in PraisonAI Platform were disclosed and assigned CVE-2026-47399, CVE-2026-47405, CVE-2026-47406, CVE-2026-47407, and CVE-2026-47409, affecting versions prior to 0.1.4. The flaws allowed authenticated users to access, modify, or delete objects across other workspaces by abusing global object IDs and weak workspace-scoped route validation, while separate authorization failures let ordinary workspace members promote themselves to owner, alter member roles, remove other users, and even delete or fully take over a workspace. One issue also allowed cross-workspace issue linking through unchecked dependency endpoints, and the combined impact broke tenant isolation across agents, projects, issues, comments, and membership management.
The vendor merged fixes into the PraisonAI repository through pull request #1686 and commit 24385d64876577620f749957bd4814f162f4ca47, adding workspace ownership checks to service and route layers, tightening role-based access control so only owners can grant privileged roles, and scoping dependency operations to authorized parent issues. The update also changed the default platform bind address from 0.0.0.0 to 127.0.0.1, reducing exposure for internet-reachable deployments. Earlier reporting had grouped the PraisonAI bugs among accepted GitHub Security Lab findings that initially lacked public CVEs, but the issues are now publicly tracked and fixed in version 0.1.4.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Public CVE records were published for several PraisonAI Platform vulnerabilities affecting versions prior to 0.1.4, covering cross-workspace object access, dependency endpoint IDOR, member-to-owner privilege escalation, combined IDOR and role escalation, and arbitrary member removal. The advisories state that version 0.1.4 fixes these tenancy and authorization issues.
Bugflation published a roundup of nine accepted GitHub Security Lab reports without public CVEs, including PraisonAI issues involving privilege escalation and access-control bypass. The post states the affected projects had accepted or remediated the reports and grouped them as a no-CVE Taskflow Agent cluster for tracking.
PraisonAI merged pull request #1686 into main, adding workspace ownership checks across platform services, tightening role-based access control, scoping dependency deletion, and changing the default bind address from 0.0.0.0 to 127.0.0.1. The associated commit notes the code was fixed on main while advisory publication and PyPI release were still pending.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcebugflation.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PraisonAI, a multi-agent teams platform, disclosed two high-severity vulnerabilities affecting versions before **4.5.97** and **4.5.90**. The more severe issue, tracked as `CVE-2026-34953`, stems from `OAuthManager.validate_token()` returning `True` for tokens missing from its internal store, which is empty by default. That logic flaw lets attackers present arbitrary Bearer tokens to authenticate to the MCP server and gain full access to registered tools and agent capabilities. The vulnerability was classified as **CWE-863** with a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. A second flaw, `CVE-2026-34934`, exposed PraisonAI to second-order SQL injection through `get_all_user_threads`. In affected versions before **4.5.90**, the function constructed raw SQL queries with Python f-strings using unescaped thread IDs previously stored in the database, allowing an attacker to plant a malicious thread ID via `update_thread` and trigger injection when thread lists were loaded. The bug could lead to full database compromise and was classified as **CWE-89** with a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`; both issues were addressed in patched releases published through GitHub Security Advisories.
Jun 29, 2026
PraisonAI disclosed two high-severity vulnerabilities affecting its multi-agent teams platform, both tied to unsafe handling of templates. **CVE-2026-39891** affects versions before `4.5.115` and allows template injection through agent tool definitions: the `create_agent_centric_tools()` function returns tools that render file content as templates, so unescaped input supplied via `agent.start()` can cause template expressions to execute rather than be treated as plain text. The flaw is tracked as **CWE-94** and carries a CVSS v3.1 score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. A second issue, **CVE-2026-40154**, affects versions before `4.5.128` and exposes PraisonAI to remote template code execution through untrusted externally fetched template files. The advisory says the product treated remote templates as trusted executable code without integrity checks, origin validation, or user confirmation, creating a supply-chain attack path for malicious templates. That vulnerability is mapped to **CWE-829** with CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`. PraisonAI fixed the issues in versions `4.5.115` and `4.5.128`, with GitHub advisories published as **GHSA-hwg5-x759-7wjg** and **GHSA-pv9q-275h-rh7x**.
Jun 29, 2026
Two high-severity vulnerabilities in PraisonAI exposed its Python sandbox protections to bypass, allowing arbitrary code execution when untrusted agent code was run. `CVE-2026-39888` affected versions prior to `1.5.115` in `praisonaiagents.tools.python_tools.execute_code()` when `sandbox_mode` defaulted to `sandbox`; the subprocess wrapper relied on a restricted `__builtins__` dictionary and an incomplete AST blocklist that omitted frame-traversal attributes including `__traceback__`, `tb_frame`, `f_back`, and `f_builtins`. By catching an exception and traversing frames, an attacker could recover the real Python builtins from the wrapper frame and invoke `exec`, defeating the intended sandbox restrictions. A second flaw, `CVE-2026-40158`, affected PraisonAI versions prior to `4.5.128` in `_execute_code_direct` within `praisonaiagents/tools/python_tools.py`. That sandbox used AST filtering to block dangerous Python attributes, but only inspected `ast.Attribute` nodes and missed dynamic attribute resolution through built-in mechanisms such as `type.__getattribute__`. Attackers could therefore reach blocked capabilities such as `__subclasses__` through a trampoline technique because the string appeared as an `ast.Constant` rather than an `ast.Attribute`, undermining the protection model until the vendor patched the issue in `4.5.128`.
Jun 29, 2026