CVE-2026-55529 in PraisonAI
Summary
by MITRE • 08/25/2026
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream _validate_origin method accepts request_origin.startswith(allowed), so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit tools/call requests to the local MCP server and execute exposed tools. This issue is fixed in version 4.6.58.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in PraisonAI versions prior to 4.6.58 represents a critical security flaw within its Model Context Protocol (MCP) HTTP Stream implementation, specifically located in the _validate_origin method. This component is responsible for enforcing Cross-Origin Resource Sharing policies by validating the origin of incoming requests against an allowlist. The core technical failure stems from the use of a substring matching logic rather than strict equality checking when evaluating allowed origins. Specifically, the code utilizes the startswith function to determine if the request's HTTP Origin header begins with any string present in the configured allowed list. This implementation oversight creates a significant bypass mechanism for attackers seeking to exploit local services that are bound to localhost interfaces.
The operational impact of this flaw is severe because it allows an attacker-controlled webpage hosted on a different domain, such as evil.example.com, to successfully authenticate its origin against a whitelist intended only for localhost addresses. By crafting the Origin header to begin with localhost but appending malicious subdomains or paths like localhost.evil.example, the request passes validation checks that were designed to restrict access exclusively to trusted local sources. Consequently, without requiring an API key or additional authentication tokens, any web page can submit tools/call requests directly to the local MCP server. This effectively nullifies the security boundary between untrusted external content and sensitive internal tooling exposed by the PraisonAI agent system.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves an authorization bypass that allows unauthorized actors to access protected resources. Furthermore, in the context of the MITRE ATT&CK framework, this behavior is indicative of T1505.003 Web Protocols: Server Message Block (SMB), although more broadly applicable here as a generic web-based server-side request forgery or cross-origin abuse scenario where local services are improperly exposed to external origins. The exploitation does not require complex network positioning since it relies on the victim user visiting a malicious webpage while having the vulnerable PraisonAI instance running locally, leveraging browser trust mechanisms that were incorrectly validated by the application logic.
The remediation for this issue involves updating PraisonAI to version 4.6.58 or later, where the origin validation logic has been corrected to enforce strict matching rather than prefix-based substring checks. To mitigate similar risks in other systems, developers should ensure that origin validation uses exact string comparison against a predefined list of trusted origins. Additionally, it is advisable to implement additional security controls such as requiring explicit API keys for tool execution even when the origin is validated, employing Content Security Policy headers to restrict script sources, and ensuring that local services are not bound to public network interfaces unless absolutely necessary. Regular auditing of access control mechanisms against industry standards like CWE-284 helps prevent these types of authorization bypasses in multi-agent systems and other web applications handling sensitive tool calls.