CVE-2026-55532 in PraisonAI
Summary
by MITRE • 08/25/2026
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in PraisonAI versions prior to 4.6.58 represents a critical flaw in the implementation of Cross-Origin Resource Sharing (CORS) validation within its Model Context Protocol HTTP Stream handler. The core technical deficiency lies in the logic used by the _validate_origin function, which relies on a naive string prefix check using request_origin.startswith(allowed). This approach fails to account for domain suffix variations, specifically allowing an attacker-controlled domain such as localhost.attacker.com to satisfy an allowlist intended exclusively for the legitimate localhost origin. By treating any subdomain or appended suffix of allowed origins as valid, the system inadvertently grants cross-origin access privileges to malicious actors who can register domains that mimic local development environments. This misconfiguration effectively bypasses browser-based security controls designed to prevent unauthorized data exfiltration and state-changing actions from untrusted sources.
The operational impact of this vulnerability is severe due to its interaction with PraisonAI's multi-agent architecture and tool invocation mechanisms. Because the flawed origin validation allows requests without triggering a preflight OPTIONS request, an attacker can execute simple HTTP POST requests directly from a malicious webpage hosted on their controlled domain. These requests target the tools/call endpoint, which serves as the interface for agents to perform actions such as file system modifications or code execution. Crucially, this exploitation path does not require authentication via API keys when accessed through these unvalidated cross-origin requests. This absence of required authorization combined with the origin bypass allows an attacker to invoke arbitrary agent capabilities remotely, turning a local development tool into a vector for remote compromise without user interaction beyond visiting a malicious site or being tricked by social engineering tactics that trigger automated scripts.
The specific actions enabled by this vulnerability include writing files and persisting agent instructions on the target system. This capability allows an attacker to plant persistent backdoors, modify configuration files, or inject malicious prompts into the AI agents' context windows. Once injected, these malicious instructions can influence future agent behavior, leading to further unauthorized operations such as data exfiltration, lateral movement within connected systems, or execution of arbitrary code depending on the tools available to the agents. This scenario aligns with CWE-942, which describes permissions bypass through origin validation errors, and maps directly to MITRE ATT&CK technique T1505.003, indicating server-side request forgery components that facilitate unauthorized access. The ability to write files without authentication also touches upon CWE-732, involving improper permission assignment for critical resources.
To mitigate this vulnerability, organizations must immediately upgrade PraisonAI to version 4.6.58 or later, where the origin validation logic has been corrected to perform strict domain matching rather than prefix-based substring checks. In addition to upgrading, it is advisable to implement stricter CORS policies that explicitly whitelist only known and trusted origins using exact string equality comparisons. Furthermore, developers should enforce authentication requirements for all sensitive endpoints like tools/call regardless of the request source, ensuring that API keys or session tokens are validated before any tool execution occurs. Implementing Content Security Policy headers can also help mitigate potential cross-site scripting vectors that might be used to exploit this flaw in browser contexts. Regular security audits focusing on origin validation logic and authentication enforcement across all API endpoints will prevent similar misconfigurations from arising in future updates.