CVE-2026-57124 in PraisonAI
Summary
by MITRE • 09/14/2026
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The PraisonAI platform operates as a multi-agent team system designed to facilitate complex artificial intelligence workflows through coordinated agent interactions. A critical security flaw was identified in versions prior to 4.6.59, specifically within the default user interface host applications that serve as the entry point for administrative and operational controls. This vulnerability centers on an unauthenticated remote code execution pathway exposed via the POST /api/mcp/connect endpoint. The design of this API endpoint failed to implement mandatory authentication checks before processing incoming requests, allowing any network-reachable client to interact with sensitive system functions without providing valid credentials or session tokens.
The technical nature of this flaw involves the improper validation and handling of caller-controlled input parameters. Specifically, the endpoint accepts command strings and argument values provided by the requester and passes them directly to the StdioMCPClient component for execution as a local process. This mechanism is intended for legitimate management tasks but lacks sufficient sanitization or access control boundaries. Because the UI services are configured to bind to 0.0.0.0 by default, they listen on all available network interfaces rather than restricting access to localhost only. Consequently, an attacker located outside the host machine can establish a connection and submit maliciously crafted commands that bypass security expectations due to the absence of authentication gates at this specific API layer.
The operational impact of this vulnerability is severe, as it enables unauthenticated remote code execution under the context of the UI service account. Even if the subsequent Model Context Protocol handshake fails or encounters an error during validation, the initial command submission and process initiation may still occur depending on the exact timing and implementation details of the race condition or state management within the application logic. This means that a reachable unauthenticated client can execute arbitrary commands with the privileges assigned to the PraisonAI UI service account. Depending on how this account is configured in the underlying operating system, an attacker could potentially compromise the integrity of the host environment, exfiltrate sensitive data stored locally, or use the compromised instance as a pivot point for further network attacks against other systems within the infrastructure.
This vulnerability aligns with CWE-287, which describes Improper Authentication, where the software does not properly verify that an entity has claimed a specific identity and possesses the necessary credentials to access resources. Furthermore, it relates to CWE-94, Code Injection, as user-controlled input is directly passed to system-level command execution functions without adequate sanitization or context-aware escaping. From a threat modeling perspective using the MITRE ATT&CK framework, this flaw facilitates Initial Access through unauthenticated API endpoints and enables Execution via remote code execution capabilities. The binding of services to all interfaces rather than localhost exacerbates the risk by expanding the attack surface beyond trusted internal networks to potentially public-facing internet spaces if not properly firewalled at a network perimeter level.
Mitigation strategies for this vulnerability involve immediate upgrading to version 4.6.59 or later, where these authentication and input validation controls have been corrected. For environments that cannot immediately upgrade, defensive measures should include configuring the UI host applications to bind exclusively to localhost addresses such as 127.0.0.1 rather than 0.0.0.0, thereby restricting access to local processes only. Additionally, implementing network-level firewall rules to block external traffic from reaching ports associated with these API endpoints provides a critical layer of defense in depth. Security teams should also audit the privileges assigned to the PraisonAI UI service account, ensuring it operates under least-privilege principles to minimize potential damage if similar vulnerabilities are discovered in other components of the system.