CVE-2026-57123: PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

Published Sep 14, 2026
·
Updated

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.runsse and launchtoolsmcpserver bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.

Affected Software

1 affected component
praisonaiagents 1.6.59<1.6.59

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade praisonaiagents to a version that resolves this vulnerability.

    Fixed in 1.6.59

Event History

Sep 14, 2026
CVE Published
via MITRE·02:46 PM
Data Sourced
via MITRE·02:46 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed?

Deployments using praisonaiagents before 1.6.59 that run ToolsMCPServer.run_sse or launch_tools_mcp_server are exposed if a client can reach the server. The affected SSE transport binds to 0.0.0.0 and exposes the /sse and /messages routes.

2

What does an attacker need to exploit this?

A remote attacker needs only network reachability to the exposed MCP SSE server; no authentication or user interaction is required. A browser can also target a local instance through DNS rebinding because Origin validation and DNS-rebinding controls are not invoked.

3

What can an attacker do after reaching the server?

An attacker can list and invoke registered tools. The resulting impact depends on the tools registered by the deployment, including file, shell, and code-execution tools.

4

Is enabling the bundled SecurityConfig an effective mitigation on affected versions?

No. In affected versions, the SSE server routes are created without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls.

5

What version fixes the issue?

The issue is fixed in praisonaiagents 1.6.59.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203