https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 09:10:29 +0000 https://db.gcve.eu/vuln/cve-2026-61427 <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs &#39;praisonai mcp serve --transport http-stream&#39; without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).</p> <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs &#39;praisonai mcp serve --transport http-stream&#39; without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is also permitted) can initialize a session, enumerate the available tools (tools/list), and invoke tools (tools/call). Additionally, the dispatcher forwards tool-call arguments to handlers without validating them against the advertised inputSchema. The server binds to 127.0.0.1 by default, so remote exploitation requires the operator to bind to a network-accessible address (e.g., --host 0.0.0.0).</p> https://db.gcve.eu/vuln/cve-2026-61427 https://db.gcve.eu/vuln/pysec-2026-4257 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>## Summary</p> <p>PraisonAI&#39;s MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults `--api-key` to `None`, so `praisonai mcp serve --transport http-stream` exposes the full MCP surface unauthenticated. A request with no `Authorization` (and no `Origin`) can `initialize` and `tools/list` (~50 tools), and the dispatcher forwards tool-call arguments to handlers without validating them against the advertised `inputSchema`. Runtime-confirmed for unauthenticated `initialize`/`tools/list` and the dispatcher schema-bypass. This is **not** an RCE/file-read in 4.6.63 — `workflow.run`/`workflow.run_file` are runtime-refuted (adapter regression). Severity Medium–High.</p> <p>## Details</p> <p>### Affected component - Package: `praisonai` 4.6.63. Files: `src/praisonai/praisonai/mcp_server/transports/http_stream.py`, `mcp_server/cli.py`, `mcp_server/server.py` (dispatcher).</p> <p>### Vulnerable code / root cause</p> <p>Path: `src/praisonai/praisonai/mcp_server/transports/http_stream.py`</p> <p>Function: `mcp_post` / `_validate_origin`</p> <p>Snippet: ```python if self.api_key: # auth applied ONLY when api_key is set auth_header = request.headers.get(&#34;Authorization&#34;, &#34;&#34;) if not auth_header.startswith(&#34;Bearer &#34;) or auth_header[7:] != self.api_key: return JSONResponse({&#34;error&#34;: &#34;Unauthorized&#34;}, status_code=401) # _validate_origin: returns True when the Origin header is absent ``` Issue: with `api_key=None`, no auth check runs; a missing `Origin` head…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>## Summary</p> <p>PraisonAI&#39;s MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults `--api-key` to `None`, so `praisonai mcp serve --transport http-stream` exposes the full MCP surface unauthenticated. A request with no `Authorization` (and no `Origin`) can `initialize` and `tools/list` (~50 tools), and the dispatcher forwards tool-call arguments to handlers without validating them against the advertised `inputSchema`. Runtime-confirmed for unauthenticated `initialize`/`tools/list` and the dispatcher schema-bypass. This is **not** an RCE/file-read in 4.6.63 — `workflow.run`/`workflow.run_file` are runtime-refuted (adapter regression). Severity Medium–High.</p> <p>## Details</p> <p>### Affected component - Package: `praisonai` 4.6.63. Files: `src/praisonai/praisonai/mcp_server/transports/http_stream.py`, `mcp_server/cli.py`, `mcp_server/server.py` (dispatcher).</p> <p>### Vulnerable code / root cause</p> <p>Path: `src/praisonai/praisonai/mcp_server/transports/http_stream.py`</p> <p>Function: `mcp_post` / `_validate_origin`</p> <p>Snippet: ```python if self.api_key: # auth applied ONLY when api_key is set auth_header = request.headers.get(&#34;Authorization&#34;, &#34;&#34;) if not auth_header.startswith(&#34;Bearer &#34;) or auth_header[7:] != self.api_key: return JSONResponse({&#34;error&#34;: &#34;Unauthorized&#34;}, status_code=401) # _validate_origin: returns True when the Origin header is absent ``` Issue: with `api_key=None`, no auth check runs; a missing `Origin` head…</p> https://db.gcve.eu/vuln/pysec-2026-4257