CVE-2026-57124: PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands bind to 0.0.0.0 by default, a reachable unauthenticated client can execute commands as the UI service account even when the MCP handshake later fails. This vulnerability is fixed in 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAI UIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
PraisonAI UI versions before 4.6.59 are exposed when their UI service is reachable by an unauthenticated client. The default UI command binding to 0.0.0.0 can make the endpoint network-reachable.
What does an attacker need to exploit this issue?
An attacker only needs network access to the POST /api/mcp/connect endpoint. No authentication, privileges, or user interaction are required, and the attacker can supply command and args values.
Does a failed MCP handshake prevent command execution?
No. The supplied process is started by StdioMCPClient before a later MCP handshake failure, so command execution can still occur.
What account runs the attacker-controlled command?
The command executes as the account running the PraisonAI UI service.
What version fixes the issue?
Upgrade PraisonAI UI to version 4.6.59, which fixes the vulnerability.