CVE-2026-57139 in PraisonAI
Summary
by MITRE • 09/15/2026
PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within PraisonAI versions ranging from 1.5.0 through 1.7.2 represents a critical failure in network security configuration, specifically involving the MCPServer.startHttp() function located in the source file src/praisonai-ts/src/mcp/server.ts. This component is responsible for initializing an HTTP server to facilitate communication between multi-agent teams and external clients. The core technical flaw lies in the binding mechanism of this server instance, which was configured without a host restriction. In standard network programming practices, failing to bind a service to a specific local interface or localhost address results in the service listening on all available network interfaces, including public-facing ones if present. This misconfiguration effectively exposes the internal management and control plane of the PraisonAI system to any client capable of reaching the designated port over the network, regardless of whether that access is intended for administrative use or external interaction.
Beyond the binding issue, the server implementation lacks essential authentication and authorization mechanisms for incoming HTTP POST requests. Upon receiving a request, the server blindly forwards it to the handleRequest() function without verifying the identity or permissions of the caller. This design decision creates an unauthenticated API endpoint that is accessible to any network actor with connectivity to the affected port. The exposed endpoints include tools/list, which allows enumeration of available agent capabilities; tools/call, which permits the execution of registered tool functions; resources/read, enabling access to internal data structures or files managed by the agents; and prompts/get, allowing retrieval of system prompts that may contain sensitive contextual information or instructions. Because these operations are executed with the privileges of the server process, an attacker can leverage them to perform actions equivalent to those of a fully authenticated administrator within the PraisonAI ecosystem.
The operational impact of this vulnerability is severe due to the high-privilege nature of the exposed functions. An unauthenticated remote attacker can enumerate the system's capabilities by calling tools/list, thereby gaining insight into what automated tasks are available for exploitation. More critically, the ability to invoke tools/call allows an attacker to execute arbitrary commands or operations defined within the agent framework using server-side credentials. This could lead to complete compromise of the underlying host environment if any registered tool involves shell execution, file system access, or network communication. Furthermore, accessing resources/read and prompts/get facilitates information disclosure, potentially revealing sensitive data processed by the agents or proprietary logic embedded in prompt templates. The combination of unrestricted binding and lack of authentication transforms a development or internal management interface into an open gateway for remote code execution and data exfiltration.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as well as CWE-798, concerning the use of hardcoded default credentials or configuration values that allow unauthorized access. From a tactical perspective, it maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter if tools/call enables script execution, and T1213 Data from Information Repositories for accessing resources/read. Although an initial remediation was released in version 1.7.2, organizations running affected versions must immediately upgrade to the patched release or apply manual mitigations until migration is complete. Recommended immediate actions include configuring a reverse proxy with strict access control lists to restrict port exposure to trusted IP ranges only, implementing mutual TLS authentication for all API endpoints, and auditing registered tools to ensure they do not execute high-privilege commands without additional safeguards. Long-term remediation should involve adopting a zero-trust architecture where every request is authenticated and authorized before being processed by the application logic, ensuring that management interfaces are never exposed directly to untrusted networks.