CVE-2026-57139: PraisonAI MCPServer exposes unauthenticated HTTP tools/call
PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or authorization. Any network client that can reach the port can call tools/list, tools/call, resources/read, or prompts/get, causing registered handlers to run with server-side credentials and process privileges or disclose registered data. An initial remediation was released in version 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAI MCPServerto a version that resolves this vulnerability.Fixed in 1.7.2 - Configuration
In versions from 1.5.0 until 1.7.2 where MCPServer.startHttp() binds without a host restriction, change it to bind the HTTP listener to an allowed host/interface so that only intended network clients can reach it.
PraisonAI MCPServer (src/praisonai-ts/src/mcp/server.ts, startHttp) Host binding restriction for HTTP server = bind only to an allowed interface/host (not all interfaces) - Configuration
For versions 1.5.0 until 1.7.2, MCPServer forwards every HTTP POST request to handleRequest() without authentication/authorization. Add enforcement so tools/call (and related endpoints such as tools/list, resources/read, prompts/get) require authentication and are authorized before registered handlers run.
PraisonAI MCPServer (HTTP request handling) Authentication/authorization for tools endpoints = require authentication and authorization before forwarding requests to handleRequest()
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated access?
Any PraisonAI deployment using MCPServer.startHttp() that has a reachable HTTP port is exposed, because the server binds without a host restriction and does not authenticate or authorize POST requests. Exposure depends on whether a network client can reach that port.
What can an unauthenticated attacker do?
An attacker who can reach the HTTP port can invoke tools/list, tools/call, resources/read, and prompts/get. Registered handlers may execute with the server's credentials and process privileges, and registered data may be disclosed.
Is authentication required to exploit this issue?
No. The affected HTTP request path forwards POST requests to handleRequest() without authentication or authorization, and the listed vector indicates no privileges or user interaction are required.
What should be done if updating cannot happen immediately?
Restrict network access to the MCPServer HTTP port so untrusted clients cannot reach it. This directly limits the described attack condition, which requires network reachability to the port.
Which versions are identified as affected or remediated?
The issue is described as affecting versions from 1.5.0 until 1.7.2, and version 1.7.2 is identified as an initial remediation release.