CVE-2026-57112: PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.runsse() in src/praisonai-agents/praisonaiagents/mcp/mcpserver.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without default Host, Origin, or authentication enforcement. A malicious website can use DNS rebinding against a reachable local or internal SSE server, supply attacker-controlled Host and Origin headers, enumerate registered tools, and invoke them with the server user's privileges. The Streamable HTTP transport rejects the same hostile Origin, which isolates the flaw to the legacy SSE wrapper. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaiagentsto a version that resolves this vulnerability.Fixed in 1.6.59 - Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using the legacy SSE transport on the /sse and /messages/ endpoints are exposed when the server is reachable from a user's browser, including on local or internal networks. The issue is isolated to the legacy SSE wrapper; the Streamable HTTP transport rejects the hostile Origin used in this attack.
What does an attacker need to exploit this?
An attacker needs to get a user to visit a malicious website and use DNS rebinding to reach the local or internal SSE server. The attacker can then provide controlled Host and Origin headers, enumerate registered tools, and invoke them with the privileges of the user running the server.
Is authentication or Host/Origin validation enabled by default on the affected endpoints?
No. The legacy ToolsMCPServer.run_sse() wrapper mounts the affected endpoints without default Host validation, Origin enforcement, or authentication enforcement.
What should be used if the legacy SSE transport cannot be patched immediately?
Avoid relying on the legacy /sse and /messages/ transport where possible and use the Streamable HTTP transport, which rejects the hostile Origin described in the advisory. An initial remediation was released in praisonaiagents 1.6.59 and PraisonAI 4.6.59.