CVE-2026-57123 in praisonaiagents
Summary
by MITRE • 09/14/2026
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The identified vulnerability resides within the PraisonAI multi-agent team system, specifically affecting versions prior to 1.6.59 of the praisonaiagents package. The core technical flaw stems from the improper implementation of security controls in two critical functions: ToolsMCPServer.run_sse and launch_tools_mcp_server. These components are responsible for establishing Server-Sent Events (SSE) connections and launching Model Context Protocol servers, respectively. In vulnerable versions, these services bind to 0.0.0.0, which instructs the operating system to listen on all available network interfaces rather than restricting access to localhost or a specific internal IP address. This configuration choice exposes the service directly to external networks if the host machine has any public-facing interface, fundamentally compromising the intended isolation of the agent environment.
The severity of this misconfiguration is compounded by the fact that these endpoints create routes for /sse and /messages/ without invoking essential security middleware. Specifically, the application fails to enforce SecurityConfig authentication protocols, origin-validation checks via CORS headers, or DNS-rebinding protections. As a result, any client capable of reaching the network port where the service is listening can interact with the system. There are no barriers preventing unauthorized entities from enumerating registered tools through the SSE interface and subsequently invoking them. This lack of access control allows attackers to execute arbitrary commands defined by the tool definitions without providing credentials or satisfying other authentication requirements, effectively bypassing the application's intended security boundaries.
The operational impact of this vulnerability is significant due to the nature of the tools available in a multi-agent AI system. PraisonAI agents often utilize powerful capabilities such as file system manipulation, shell command execution, and arbitrary code interpretation. An attacker who can list these tools gains visibility into the system's capabilities, while an attacker who can invoke them achieves remote code execution on the host machine running the agent. The extent of this impact is determined by the privileges under which the PraisonAI process runs. If executed with elevated permissions, such as root or administrator rights, the vulnerability allows for complete compromise of the underlying operating system, including data exfiltration, persistence establishment, and lateral movement within a network environment.
This flaw aligns closely with CWE-284 Improper Access Control, as it involves a failure to restrict access to resources based on user identity or context. Furthermore, the ability for an attacker to list and invoke tools remotely corresponds to ATT&CK technique T1059 Command and Scripting Interpreter, particularly when shell execution is involved. The specific mention of DNS rebinding indicates that even if the service were bound only to localhost, a browser-based attack vector could potentially bypass same-origin policies by manipulating domain resolution during an active session. This highlights a critical gap in how the application handles cross-site requests and validates the origin of incoming connections against its own binding configuration.
To mitigate this vulnerability, organizations must immediately upgrade the praisonaiagents package to version 1.6.59 or later, where these security controls have been properly implemented. In addition to upgrading, it is advisable to review network configurations to ensure that services intended for internal use are not exposed on public interfaces unless absolutely necessary and protected by a reverse proxy with its own authentication layer. Implementing strict CORS policies that whitelist only known trusted origins can further reduce the risk of unauthorized cross-origin requests. For environments where external access is required, deploying an API gateway or web application firewall to enforce rate limiting and request validation provides an additional defense-in-depth measure against exploitation attempts.